CVE-2026-92713

HighCVSS 8.1

Published: 25/09/2026(UTC)Updated: 25/09/2026(UTC)Translated: 25/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress (versions up to and including 3.0.2) is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_image function. An authenticated attacker with author-level access or higher can delete arbitrary files on the server. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and authors trivially satisfy the edit_post check on their own galleries.

Risk Assessment

An attacker can delete critical files, causing site outage or data loss. This requires an author-level account, which may be easy to obtain in some configurations.

Recommendation

Update the plugin to a version newer than 3.0.2 if available. Otherwise, limit the number of author-level accounts and maintain regular backups.

Other vulnerabilities in Modula Image Gallery – Photo Grid & Video Gallery

CVE-2026-89406High
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress (versions up to and including 3.0.1) is vulnerable to unauthorized disclosure of private gallery contents. The Modula_Meta::add_metas() function is hooked to wp_head on every frontend request and looks up any post via get_post($_GET['modula_gallery_id']) without verifying the gallery's post_status or the requester's capability to read it. An unauthenticated attacker can enumerate private modula-gallery posts and their member attachments and recover the image's title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags, allowing direct unauthenticated download of the original private image bytes.

Original NVD description (English source)

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_image function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and Authors trivially satisfy the edit_post check on their own galleries.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS