Introduction
Deleting a single file can hand control of a WordPress site to an attacker. CVE-2025-13322 in the WP AUDIO GALLERY plugin shows how weak file path validation can let even low-privileged users compromise an entire installation. This summary covers how the flaw works, which versions are affected, and where to read more.
WP AUDIO GALLERY is a plugin in the official WordPress repository that adds audio playback and playlist management to WordPress sites. Its user base is smaller than some of the most popular plugins, but it runs in production environments and is held to the same security expectations as any other plugin in the WordPress ecosystem.
Technical information
CVE-2025-13322 affects all versions of WP AUDIO GALLERY up to and including 2.0. The flaw is in the wpag_uploadaudio_callback() AJAX handler, which any authenticated user can reach through the admin-ajax.php endpoint. The handler takes an audio_upload parameter that is meant to hold the path of an uploaded audio file.
The handler passes that user-supplied path to PHP's unlink() function without validating or sanitizing it. An attacker can put directory traversal sequences such as ../ in the audio_upload parameter and delete arbitrary files on the server. For example, an attacker could target wp-config.php in the WordPress root directory. With that file gone, the site drops into installation mode, and the attacker can take it over.
The vulnerable code locations are publicly documented:
The root cause is a classic case of CWE-73: External Control of File Name or Path. The plugin does not restrict file operations to a safe directory, and it does not check user input for traversal patterns.
Affected systems and versions
All versions of WP AUDIO GALLERY up to and including 2.0 are affected. The configuration makes no difference: the vulnerability is present whenever the plugin is active and subscriber-level users can authenticate.
Vendor security history
Before this CVE, WP AUDIO GALLERY had no widely reported major security incidents. Arbitrary file deletion vulnerabilities have turned up in other WordPress plugins, though, often because of similar input validation oversights. How the plugin responds to this vulnerability, and how it handles patching from here, will be important indicators of its security maturity.
