CVE-2026-89406
Received Received - Intake

Information Disclosure in Modula Image Gallery WordPress Plugin

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: Wordfence

Description
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the Modula_Meta::add_metas() function being hooked to wp_head on every frontend request and looking up any post via get_post( $_GET['modula_gallery_id'] ) without verifying the gallery's post_status or the requester's capability to read it — the gallery-side input guard is bugged (empty('modula_gallery_id') tests a nonempty string literal instead of the GET parameter, so it is always false), the only object validation is a post_type === 'modula-gallery' check, and no is_user_logged_in()/current_user_can('read_post', $gallery_id) check is performed. This makes it possible for unauthenticated attackers to enumerate private modula-gallery posts and their member attachments and recover the image's title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags emitted in the response, which then allows direct unauthenticated download of the original private image bytes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-89406
EUVD
EUVD-2026-86602

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
modula modula_image_gallery to 3.0.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Modula Image Gallery WordPress plugin up to version 3.0.1 has an issue where private gallery contents can be accessed without authorization. The plugin's function hooked to wp_head incorrectly checks for a gallery ID parameter, allowing unauthenticated attackers to view private galleries by directly accessing a URL with the gallery ID. The plugin does not verify user permissions or gallery status before exposing sensitive information like image titles, descriptions, and URLs via meta tags.

Detection Guidance

Check for unauthorized access to private gallery contents by monitoring requests to the WordPress site with parameters like modula_gallery_id. Look for unusual GET requests or meta tag exposure in responses. Use tools like curl to test if private galleries can be accessed without authentication.

Impact Analysis

This vulnerability allows attackers to access private image galleries and download original private images without authentication. Attackers can enumerate all private galleries, view their contents, and retrieve image metadata and direct download links. This could lead to unauthorized access to sensitive or proprietary visual content stored in the galleries.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations such as GDPR or HIPAA if private images contain personal or sensitive data. Unauthorized access to private galleries may result in data breaches, violating confidentiality requirements and potentially leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the Modula Image Gallery plugin to the latest version beyond 3.0.1. If an update is unavailable, disable the plugin temporarily. Review server logs for suspicious activity related to modula_gallery_id requests. Implement access controls to restrict unauthorized access to private galleries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89406. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart