Wp Audio Gallery
Approved changes feed: RSS · Atom
cpe:2.3:a:husainali52:wp_audio_gallery:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Husainali52 (5ef8c017-93c1-5c5b-be6e-6099510046a8) |
|---|---|
| Product | Wp Audio Gallery (f2ab2c02-b612-5be4-8319-7af199fd89b0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-13603 |
vulnerable | 2026-06-08 07:04:32.676817 |
WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Read via .htaccess Manipulation
HIGH (8.8)
The WP AUDIO GALLERY plugin for WordPress is vulnerable to Unauthorized Arbitrary File Read in all versions up to, and including, 2.0. This is due to insufficient capability checks and lack of nonce verification on the "wpag_htaccess_callback" function This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's .htaccess file with arbitrary content, which can lead to arbitrary file read on the server under certain configurations.
Published: 2026-02-19T04:36:17.771Z
Updated: 2026-04-08T17:04:32.795Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13322 |
vulnerable | 2026-06-08 07:04:32.003721 |
WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Deletion via 'audio_upload' Parameter
HIGH (8.1)
The WP AUDIO GALLERY plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 2.0. This is due to the `wpag_uploadaudio_callback()` AJAX handler not properly validating user-supplied file paths in the `audio_upload` parameter before passing them to `unlink()`. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when critical files like wp-config.php are deleted.
Published: 2025-11-21T07:31:46.308Z
Updated: 2026-04-08T16:35:54.131Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.