WordPress Gallery Plugin Arbitrary File Deletion Flaw

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_image function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and Authors trivially satisfy the edit_post check on their own galleries.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Modula Image Gallery plugin for WordPress contains a critical arbitrary file deletion vulnerability in versions up to 3.0.2, stemming from insufficient path validation in the upload_image function. Authenticated users with author-level privileges or higher can exploit inadequate file path sanitization to delete arbitrary files from the server, bypassing the intended wp-content/uploads restriction. This vulnerability is particularly dangerous because it affects a widely-used plugin, impacts all WordPress installations with author-level or administrative users who may be compromised or malicious, and allows attackers to destroy critical website files, configurations, and user data. With a CVSS score of 8.1, this represents a high-severity risk that can lead to website defacement, data loss, and potential denial of service.

Casky's 283 matched security skills leverage Claude's extended reasoning to detect the attack patterns associated with this vulnerability by analyzing MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious patterns including: unexpected file deletion operations originating from authenticated WordPress sessions, particularly those with author-level permissions; abnormal wp-content/uploads directory traversal attempts using path manipulation sequences (../, encoded characters, or symbolic links); and correlations between user login activity and subsequent filesystem modifications outside normal plugin behavior. The platform's skill-based detection would flag CWE-862 (Missing Authorization) violations by monitoring for file operations that bypass expected access controls, alerting defenders to potential exploitation attempts before arbitrary files are permanently removed from the infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-92713.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-92713

Casky has 283 skills that investigate the attack patterns behind CVE-2026-92713. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn