Modula Image Gallery WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Modula Image Gallery plugin for WordPress, specifically in versions 2.13.1 prior to 2.13.2. The issue arises from inadequate file type validation in the 'ajax_unzip_file' function. This vulnerability enables authenticated attackers with Author-level access and above to upload arbitrary files to the affected site's server. The exploitation of this vulnerability could lead to remote code execution, especially considering the introduced race condition.

Impact

The vulnerability allows for unrestricted file uploads, which could be exploited to execute malicious code on the server, potentially leading to a full site compromise.

Reproduction

The vulnerability can be reproduced by uploading a ZIP file containing malicious payloads through the WordPress media uploader, using an account with Author-level access or higher. The 'ajax_unzip_file' function will be triggered, leading to the extraction of the payloads on the server.

Remediation

Users are advised to update the Modula Image Gallery plugin to version 2.13.3 or later, where this vulnerability has been fixed.