Description
The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'PostGalleryUploader' class functions in all versions up to, and including, 1.12.5. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rtowebsites | PostGallery | ≤ 1.12.5 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
Sudo-WP/sudowp-postgallery ★ 1 · Jan 17, 2026
A security-hardened fork of the abandoned "PostGallery" WordPress plugin. Fixes critical Arbitrary File Upload (CVE-2025-13543) and Guest Access vulnerabilities.
-
MooseLoveti/PostGallery-CVE-Report ★ 0 · Nov 22, 2025
Disclosure for CVE-2025-13543
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.