CVE-2025-13543

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13543", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-22T14:12:33.475Z", "datePublished": "2025-12-04T20:27:30.392Z", "dateUpdated": "2026-04-08T16:36:36.404Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:36.404Z"}, "affected": [{"vendor": "rtowebsites", "product": "PostGallery", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.12.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'PostGalleryUploader' class functions in all versions up to, and including, 1.12.5. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "title": "PostGallery <= 1.12.5 - Authenticated (Subscriber+) Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/13348eb5-5001-4ec4-bc6a-44795bbed203?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/postgallery/tags/1.12.5/admin/PostGalleryUploader.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Moose Love"}], "timeline": [{"time": "2025-12-04T07:28:57.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-09T19:40:45.895621Z", "id": "CVE-2025-13543", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T19:40:54.825Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13543", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-09T19:40:45.895621Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T19:40:51.376Z"}}], "cna": {"title": "PostGallery <= 1.12.5 - Authenticated (Subscriber+) Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Moose Love"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "rtowebsites", "product": "PostGallery", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.12.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-04T07:28:57.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/13348eb5-5001-4ec4-bc6a-44795bbed203?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/postgallery/tags/1.12.5/admin/PostGalleryUploader.php"}], "descriptions": [{"lang": "en", "value": "The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'PostGalleryUploader' class functions in all versions up to, and including, 1.12.5. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-04T20:27:30.392Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13543", "state": "PUBLISHED", "dateUpdated": "2025-12-09T19:40:54.825Z", "dateReserved": "2025-11-22T14:12:33.475Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-04T20:27:30.392Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PostGallery", "vendor": "rtowebsites", "versions": [{"lessThanOrEqual": "1.12.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'PostGalleryUploader' class functions in all versions up to, and including, 1.12.5. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible."}, {"lang": "es", "value": "El plugin PostGallery para WordPress es vulnerable a cargas de archivos arbitrarios debido a una validaci\u00f3n incorrecta del tipo de archivo en las funciones de la clase 'PostGalleryUploader' en todas las versiones hasta la 1.12.5, inclusive. Esto posibilita que atacantes autenticados, con permisos de nivel suscriptor y superiores, carguen archivos arbitrarios en el servidor del sitio afectado, lo que podr\u00eda posibilitar la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-13543", "lastModified": "2026-10-18T15:10:00.097", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13543", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-09T19:40:45.895621Z", "version": "2.0.3"}}]}, "published": "2025-12-04T21:16:08.037", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/postgallery/tags/1.12.5/admin/PostGalleryUploader.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/13348eb5-5001-4ec4-bc6a-44795bbed203?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T16:26:17.824684+00:00", "value": {"mitigation_remediation": ["Upgrade the PostGallery plugin to any version newer than 1.12.5 to remove the flaw.", "Disable file uploads for subscriber and lower roles using a WordPress security or role\u2011management plugin so that the vulnerable interface is inaccessible to potential attackers.", "Configure the web server or file system so that files uploaded through PostGallery are stored in a non\u2011executable directory and that PHP execution is disabled for that directory."], "summary": {"action": "Immediate Patch", "impact": "arbitrary file upload leading to potential remote code execution"}, "threat_synthesis": {"affected_systems": "This vulnerability affects the rtowebsites PostGallery plugin for WordPress. All installed copies of the plugin with a version number of 1.12.5 or earlier are impacted. Sites using the 1.12.5 variant or older are therefore at risk.", "description_and_impact": "The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the PostGalleryUploader class in all versions up to and including 1.12.5. The flaw allows authenticated users with subscriber level and above permissions to upload files that are not properly vetted. Because the uploaded file can be placed under a web\u2011accessible directory and may contain executable code, attackers could potentially gain remote code execution capabilities on the affected site. The weakness aligns with CWE-434: Unrestricted Upload of File with Dangerous Type.", "risk_and_exploitability": "The CVSS score of 8.8 classifies this flaw as High severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation at present, though the vulnerability remains exploitable. The flaw is not listed in CISA KEV. Attackers must be authenticated and hold at least subscriber\u2011level privileges to use the upload interface. The likely attack path is to submit a malicious file through the plugin\u2019s upload mechanism; because the file type is not validated, the server may store the file in a location that can be executed as a script, thereby enabling remote code execution."}}}}, "created": "2025-12-05T10:52:30.096995+00:00", "updated": "2026-04-22T16:30:22.141574+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}