The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress contains a path traversal flaw in the modula_list_folders AJAX endpoint. The endpoint verifies only that the requester has Author+ permissions and the upload_files and edit_posts capabilities, but it does not confirm that the supplied directory path is contained within a safe base directory. An authenticated user with these permissions can therefore pass arbitrary paths and cause the plugin to list the contents of any directory on the server that the WordPress process can read.

WordPress sites that have the Modula Image Gallery – Photo Grid & Video Gallery plugin installed, versions up to and including 2.13.3. All installations that use the default configuration of the modula_list_folders endpoint and allow Author-level users with upload_files and edit_posts capabilities are impacted.

The vulnerability has a CVSS score of 6.5, indicating a moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the near term. The issue is not listed in the CISA KEV catalog. Exploitation requires a valid WordPress account with Author or higher privileges, so the attack vector is authenticated, in‑application. If an attacker gains such a role, they can enumerate server directories via the public AJAX endpoint until the directory traversal is mitigated or the endpoint is protected.