The Modula Image Gallery – Photo Grid & Video Gallery WordPress plugin (versions up to 2.13.3) contains a path traversal vulnerability (CWE-22) in its modula_list_folders AJAX endpoint. This endpoint verifies that the user has Author-level permissions with upload_files and edit_posts capabilities but fails to restrict directory path inputs to a safe base directory. Consequently, authenticated users with sufficient privileges can manipulate the directory path parameter to enumerate arbitrary directories on the server, potentially exposing sensitive file system information. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No patch or official remediation guidance is currently available, and no exploits are known in the wild.

Authenticated users with Author-level permissions or higher can exploit this vulnerability to enumerate arbitrary directories on the server hosting the WordPress plugin. This can lead to unauthorized disclosure of sensitive file system information (confidentiality impact). There is no indication of integrity or availability impact. No known exploits are reported, but the vulnerability could aid attackers in further reconnaissance or targeted attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level user permissions to trusted users only and monitor for suspicious activity related to the modula_list_folders AJAX endpoint. Avoid granting upload_files and edit_posts capabilities to untrusted users. Follow updates from the wpchill vendor for an official patch or mitigation.