The Modula Image Gallery – Photo Grid & Video Gallery plugin allows authenticated WordPress users with author-level privileges or higher to execute an AJAX import that accepts a file path without proper validation, enabling the movement of arbitrary image files on the server. This flaw falls under CWE‑285 and can result in the deletion, relocation, or replacement of critical image assets, thereby affecting the integrity and availability of the site’s media content and potentially compromising backups or stored media.

All WordPress installations that use the Modula Image Gallery plugin by wpchill and have a plugin version of 2.12.28 or earlier, including every site configured with author or higher roles for the upload functionality.

The CVSS score of 4.3 indicates a moderate risk, and the EPSS score of less than 1% points to a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to authenticate with an account that has at least author privileges and trigger an AJAX request to the vulnerable import endpoint. Once executed, the attacker could move or delete target files on the server, leading to content loss or potential privilege escalation if the files are system-critical. The attack vector is inferred from the AJAX import function and the requirement for authenticated use; no remote code execution is implied.