Exploitation Summary
EIP tracks 2 public exploits for CVE-2025-13543. PoCs published by Sudo-WP, MooseLoveti.
AI-analyzed exploit summary This repository is a security-hardened fork of the abandoned PostGallery WordPress plugin, addressing CVE-2025-13543 (arbitrary file upload vulnerability). It includes patches for file type validation, access control, and input sanitization.
Description
The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'PostGalleryUploader' class functions in all versions up to, and including, 1.12.5. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Exploits (2)
This repository is a security-hardened fork of the abandoned PostGallery WordPress plugin, addressing CVE-2025-13543 (arbitrary file upload vulnerability). It includes patches for file type validation, access control, and input sanitization.
This repository provides a detailed writeup for CVE-2025-13543, an authenticated arbitrary file upload vulnerability in the PostGallery WordPress plugin (versions <= 1.12.5). The vulnerability allows low-privileged users (e.g., Subscribers) to upload arbitrary PHP files via directory traversal, leading to remote code execution.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H