CVE-2026-90978

HighCVSS 7.1

Published: 18/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the plugin's stored gallery options.

Risk Assessment

Low-privileged users can modify content and delete configuration data, leading to site integrity compromise.

Recommendation

Update the plugin to version 1.1.5 or later. Check the integrity of posts and gallery options.

Other vulnerabilities in Filter Gallery

CVE-2026-89413High
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.1.4. An authenticated attacker with Subscriber-level access can delete arbitrary Filter Gallery records by supplying attacker-controlled gallery IDs.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS