Security Alert Summary
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress contains a vulnerability that can disclose private gallery contents to unauthenticated attackers. A function hooked into the frontend output performs an unsafe lookup of a gallery post based on a GET parameter without verifying the post status or the requester’s read capability, causing private gallery metadata and original image URLs to be exposed via social/Open Graph meta tags.
CVE Details
- CVE ID:
CVE-2026-89406 - Affected component: Modula Image Gallery – Photo Grid & Video Gallery (plugin)
- Affected versions: Versions up to and including 3.0.1
- Published: September 25, 2026 at 8:16:40 AM
- Last modified: September 25, 2026 at 2:17:21 PM
- CVSS v3.1: Base Score 7.5, Severity HIGH, Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Authentication / Privileges / User interaction: No authentication required, no privileges required, no user interaction (from CVSS data)
- Primary impact: Confidentiality: High; Integrity: None; Availability: None
- Scope: Unchanged
- Attack vector / complexity: Network / Low
- CWE / weakness: CWE-862 (Missing Authorization)
Technical Details
The vulnerability exists because the plugin\’s Modula_Meta::add_metas() method is hooked into wp_head on every frontend request and attempts to look up a post using get_post($_GET['modula_gallery_id']) without performing proper authorization or visibility checks. A bug in the input guard uses empty('modula_gallery_id'), which tests a nonempty string literal instead of the GET parameter and is always false. The code only validates that the retrieved object has post_type === 'modula-gallery' and does not call authentication or capability checks such as is_user_logged_in() or current_user_can('read_post', $gallery_id).
As a result, unauthenticated requests can cause the plugin to emit Open Graph and Twitter meta tags containing private gallery metadata, including image title, description, dimensions, and the original upload URL. Those meta tags can be parsed by an attacker to enumerate private modula-gallery posts and to obtain direct URLs for unauthenticated download of original image files.
How This Could Impact Your Website
In a typical site workflow there may be a site owner, internal staff (editors or content contributors), and external contractors or contributors who upload or manage private gallery images. This vulnerability can expose private images and their metadata to unauthenticated users. Practical consequences include disclosure of sensitive images or descriptive metadata, and increased risk of targeted phishing or social engineering if exposed content reveals staff identities, project details, or other contextual information.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and access logs for unusual requests that include
modula_gallery_idor attempts to access gallery posts directly.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/class-modula-meta.php#L142
- https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/class-modula-meta.php#L26
- https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/class-modula-meta.php#L50
- https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/social_meta.php#L8
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3697043%40modula-best-grid-gallery&new=3697043%40modula-best-grid-gallery
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a369dff6-feca-47cf-8511-dc75c4ffdd29?source=cve
