CVE-2025-13603

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13603", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-24T13:45:25.932Z", "datePublished": "2026-02-19T04:36:17.771Z", "dateUpdated": "2026-04-08T17:04:32.795Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:32.795Z"}, "affected": [{"vendor": "husainali52", "product": "WP AUDIO GALLERY", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP AUDIO GALLERY plugin for WordPress is vulnerable to Unauthorized Arbitrary File Read in all versions up to, and including, 2.0. This is due to insufficient capability checks and lack of nonce verification on the \"wpag_htaccess_callback\" function This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's .htaccess file with arbitrary content, which can lead to arbitrary file read on the server under certain configurations."}], "title": "WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Read via .htaccess Manipulation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/852959d1-f8e0-4c1f-8a5c-5923bedc4889?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/wp-audio-gallery.php#L162"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/wp-audio-gallery.php#L647"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/lib/util-functions.php#L133"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-11-12T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-18T15:29:33.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T21:10:45.372320Z", "id": "CVE-2025-13603", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:10:57.709Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13603", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-19T21:10:45.372320Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:10:52.855Z"}}], "cna": {"title": "WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Read via .htaccess Manipulation", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "husainali52", "product": "WP AUDIO GALLERY", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-12T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-18T15:29:33.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/852959d1-f8e0-4c1f-8a5c-5923bedc4889?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/wp-audio-gallery.php#L162"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/wp-audio-gallery.php#L647"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/lib/util-functions.php#L133"}], "descriptions": [{"lang": "en", "value": "The WP AUDIO GALLERY plugin for WordPress is vulnerable to Unauthorized Arbitrary File Read in all versions up to, and including, 2.0. This is due to insufficient capability checks and lack of nonce verification on the \"wpag_htaccess_callback\" function This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's .htaccess file with arbitrary content, which can lead to arbitrary file read on the server under certain configurations."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-19T04:36:17.771Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13603", "state": "PUBLISHED", "dateUpdated": "2026-02-19T21:10:57.709Z", "dateReserved": "2025-11-24T13:45:25.932Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T04:36:17.771Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP AUDIO GALLERY", "vendor": "husainali52", "versions": [{"lessThanOrEqual": "2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP AUDIO GALLERY plugin for WordPress is vulnerable to Unauthorized Arbitrary File Read in all versions up to, and including, 2.0. This is due to insufficient capability checks and lack of nonce verification on the \"wpag_htaccess_callback\" function This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's .htaccess file with arbitrary content, which can lead to arbitrary file read on the server under certain configurations."}, {"lang": "es", "value": "El plugin WP AUDIO GALLERY para WordPress es vulnerable a la Lectura Arbitraria de Archivos No Autorizada en todas las versiones hasta la 2.0, inclusive. Esto se debe a comprobaciones de capacidad insuficientes y a la falta de verificaci\u00f3n de nonce en la funci\u00f3n 'wpag_htaccess_callback'. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, sobrescriban el archivo .htaccess del sitio con contenido arbitrario, lo que puede llevar a la lectura arbitraria de archivos en el servidor bajo ciertas configuraciones."}], "id": "CVE-2025-13603", "lastModified": "2026-06-17T08:34:25.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13603", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T21:10:45.372320Z", "version": "2.0.3"}}]}, "published": "2026-02-19T07:17:32.133", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/lib/util-functions.php#L133"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/wp-audio-gallery.php#L162"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/wp-audio-gallery.php#L647"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/852959d1-f8e0-4c1f-8a5c-5923bedc4889?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "WP AUDIO GALLERY", "source": "cna", "vendor": "husainali52"}, "product": "wp_audio_gallery", "vendor": "husainali52"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-21T15:52:55.006075+00:00", "value": {"mitigation_remediation": ["Update WP AUDIO GALLERY to the latest patched version or at least to a release beyond 2.0 where the capability checks and nonce verification have been added.", "If an update is not immediately possible, remove or disable the wpag_htaccess_callback function by deactivating the plugin, or delete the plugin from the site entirely.", "Restrict server file permissions so that the web process cannot write to .htaccess, and limit WordPress subscriber accounts to the minimum roles required for operation, discouraging the use of subscriber accounts for routine site management."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary File Read"}, "threat_synthesis": {"affected_systems": "Any installation of the WP AUDIO GALLERY plugin version 2.0 or earlier, developed by the vendor husainali52. The vulnerability exists for all WordPress sites that have the plugin activated and do not have a patched version installed.", "description_and_impact": "The WP AUDIO GALLERY plugin for WordPress is vulnerable due to missing capability checks and the absence of nonce verification in the wpag_htaccess_callback function. This flaw allows an attacker who has authenticated access at the subscriber level or higher to overwrite the site\u2019s .htaccess file with arbitrary content. In certain server configurations, this manipulation can enable the attacker to read files on the server that should otherwise be protected, representing an unauthorized data disclosure risk.", "risk_and_exploitability": "The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. The flaw is not yet listed in CISA\u2019s KEV catalog. The attack can be carried out from a web browser after an attacker has authenticated with a WordPress account that has subscriber or higher privileges, and the plugin\u2019s callback then writes malicious data to the server\u2019s .htaccess file. Once the file is altered, the attacker can read sensitive files, potentially leading to further compromise."}}}}, "created": "2026-02-19T10:07:05.141244+00:00", "updated": "2026-04-21T16:00:13.273773+00:00", "vendors": ["husainali52", "husainali52$PRODUCT$wp_audio_gallery", "wordpress", "wordpress$PRODUCT$wordpress"]}