CVE-2026-89406

HighCVSS 7.5

Published: 25/09/2026(UTC)Updated: 25/09/2026(UTC)Translated: 25/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

Summary

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress (versions up to and including 3.0.1) is vulnerable to unauthorized disclosure of private gallery contents. The Modula_Meta::add_metas() function is hooked to wp_head on every frontend request and looks up any post via get_post($_GET['modula_gallery_id']) without verifying the gallery's post_status or the requester's capability to read it. An unauthenticated attacker can enumerate private modula-gallery posts and their member attachments and recover the image's title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags, allowing direct unauthenticated download of the original private image bytes.

Risk Assessment

An attacker can access private images and their metadata, potentially leading to confidentiality breaches. The risk is high because the attack does not require authentication.

Recommendation

Update the plugin to a version newer than 3.0.1 if available. Otherwise, consider disabling the plugin or restricting access to private galleries.

Other vulnerabilities in Modula Image Gallery – Photo Grid & Video Gallery

CVE-2026-92713High
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress (versions up to and including 3.0.2) is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_image function. An authenticated attacker with author-level access or higher can delete arbitrary files on the server. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and authors trivially satisfy the edit_post check on their own galleries.

Original NVD description (English source)

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the Modula_Meta::add_metas() function being hooked to wp_head on every frontend request and looking up any post via get_post( $_GET['modula_gallery_id'] ) without verifying the gallery's post_status or the requester's capability to read it — the gallery-side input guard is bugged (empty('modula_gallery_id') tests a nonempty string literal instead of the GET parameter, so it is always false), the only object validation is a post_type === 'modula-gallery' check, and no is_user_logged_in()/current_user_can('read_post', $gallery_id) check is performed. This makes it possible for unauthenticated attackers to enumerate private modula-gallery posts and their member attachments and recover the image's title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags emitted in the response, which then allows direct unauthenticated download of the original private image bytes.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS