CVE-2025-13543Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'PostGalleryUploader' class functions in all versions up to, and including, 1.12.5. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

http://WordPress.org

Full discourse1 post

SudoWP@sudo_wp216d
Disclosure
1/6 The PostGallery WordPress plugin was closed on http://WordPress.org on Dec 2, 2025. CVE-2025-13543 (CVSS 8.8) left all versions up to 1.12.5 open to arbitrary file uploads. No vendor fix. We forked it. https://t.co/xOffmlsnRJ
Post summary
This brief tweet announces the closure of the PostGallery WordPress plugin, details CVE-2025-13543 (CVSS 8.8, arbitrary file upload flaw) affecting versions up to 1.12.5, notes no vendor fix, and shares a fork link.
50000150
5 followersView on X

Explore more

Back to dashboard