CVE-2025-13641

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13641", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-25T02:50:31.614Z", "datePublished": "2025-12-18T09:21:29.377Z", "dateUpdated": "2026-04-08T16:34:34.861Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:34.861Z"}, "affected": [{"vendor": "smub", "product": "Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.59.12", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.59.12 via the 'template' shortcode parameter. This is due to insufficient path validation that allows absolute paths to be provided. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, bypassing web server restrictions like .htaccess. Successful exploitation could lead to information disclosure, code execution in the WordPress context, and potential remote code execution if combined with arbitrary file upload capabilities."}], "title": "Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0a01e1c9-67f4-4cc1-b58b-9cc141889d66?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/nextgen-gallery/trunk/src/DisplayType/LegacyTemplateLocator.php#L152"}, {"url": "https://plugins.trac.wordpress.org/browser/nextgen-gallery/trunk/src/DisplayType/Controller.php#L369"}, {"url": "https://plugins.trac.wordpress.org/changeset/3415575/nextgen-gallery/trunk/src/DisplayType/LegacyTemplateLocator.php?old=3004370&old_path=nextgen-gallery%2Ftrunk%2Fsrc%2FDisplayType%2FLegacyTemplateLocator.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-11-25T03:18:13.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-17T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-18T14:19:16.564698Z", "id": "CVE-2025-13641", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T14:19:36.707Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13641", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-18T14:19:16.564698Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T14:19:29.940Z"}}], "cna": {"title": "Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "smub", "product": "Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.59.12"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-25T03:18:13.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-17T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0a01e1c9-67f4-4cc1-b58b-9cc141889d66?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/nextgen-gallery/trunk/src/DisplayType/LegacyTemplateLocator.php#L152"}, {"url": "https://plugins.trac.wordpress.org/browser/nextgen-gallery/trunk/src/DisplayType/Controller.php#L369"}, {"url": "https://plugins.trac.wordpress.org/changeset/3415575/nextgen-gallery/trunk/src/DisplayType/LegacyTemplateLocator.php?old=3004370&old_path=nextgen-gallery%2Ftrunk%2Fsrc%2FDisplayType%2FLegacyTemplateLocator.php"}], "descriptions": [{"lang": "en", "value": "The Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.59.12 via the 'template' shortcode parameter. This is due to insufficient path validation that allows absolute paths to be provided. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, bypassing web server restrictions like .htaccess. Successful exploitation could lead to information disclosure, code execution in the WordPress context, and potential remote code execution if combined with arbitrary file upload capabilities."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:34.861Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13641", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:34:34.861Z", "dateReserved": "2025-11-25T02:50:31.614Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-18T09:21:29.377Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery", "vendor": "smub", "versions": [{"lessThanOrEqual": "3.59.12", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.59.12 via the 'template' shortcode parameter. This is due to insufficient path validation that allows absolute paths to be provided. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, bypassing web server restrictions like .htaccess. Successful exploitation could lead to information disclosure, code execution in the WordPress context, and potential remote code execution if combined with arbitrary file upload capabilities."}], "id": "CVE-2025-13641", "lastModified": "2026-06-17T08:34:30.230", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13641", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-18T14:19:16.564698Z", "version": "2.0.3"}}]}, "published": "2025-12-18T10:16:10.953", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/nextgen-gallery/trunk/src/DisplayType/Controller.php#L369"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/nextgen-gallery/trunk/src/DisplayType/LegacyTemplateLocator.php#L152"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3415575/nextgen-gallery/trunk/src/DisplayType/LegacyTemplateLocator.php?old=3004370&old_path=nextgen-gallery%2Ftrunk%2Fsrc%2FDisplayType%2FLegacyTemplateLocator.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0a01e1c9-67f4-4cc1-b58b-9cc141889d66?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T16:05:05.593396+00:00", "value": {"mitigation_remediation": ["Upgrade the NextGEN Gallery plugin to version 3.59.13 or later, which removes the vulnerable 'template' shortcode handling.", "If an immediate upgrade is not feasible, disable the 'template' shortcode or restrict its usage by removing the capability from Contributor roles through a role management plugin or custom code.", "Strengthen file upload controls in WordPress to prevent potential remote code execution via combined LFI and arbitrary file upload paths."], "summary": {"action": "Immediate Patch", "impact": "Local File Inclusion that can lead to code execution"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts the NextGEN Gallery plugin for WordPress sold by smub under the name Songoda Audio \"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery.\" All plugin releases up to and including version 3.59.12 are affected. Users running these versions should verify that they are not running the compromised code base.", "description_and_impact": "A flaw in the NextGEN Gallery WordPress plugin allows an authenticated user with Contributor or higher privileges to supply an absolute file path to the 'template' shortcode parameter. Because the plugin lacks proper path validation, the attacker can cause the server to include arbitrary PHP files, potentially executing malicious code in the WordPress context. The vulnerability may also enable the disclosure of sensitive data and, when combined with an arbitrary file upload capability, could result in remote code execution.", "risk_and_exploitability": "The CVSS score of 8.8 classifies the flaw as critical, and the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild so far. The attacker must be authenticated and possess at least Contributor role privileges to exploit the flaw, which limits the attack surface to users already able to post content. The vulnerability is not listed in the CISA KEV catalog, but the potential for local file inclusion leading to PHP execution warrants prioritizing a patch when available."}}}}, "created": "2025-12-19T09:16:19.625282+00:00", "updated": "2026-04-22T16:15:21.788488+00:00", "vendors": ["smub", "smub$PRODUCT$nextgen_gallery", "wordpress", "wordpress$PRODUCT$wordpress"]}