CVE-2026-89406

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the Modula_Meta::add_metas() function being hooked to wp_head on every frontend request and looking up any post via get_post( $_GET['modula_gallery_id'] ) without verifying the gallery's post_status or the requester's capability to read it — the gallery-side input guard is bugged (empty('modula_gallery_id') tests a nonempty string literal instead of the GET parameter, so it is always false), the only object validation is a post_type === 'modula-gallery' check, and no is_user_logged_in()/current_user_can('read_post', $gallery_id) check is performed. This makes it possible for unauthenticated attackers to enumerate private modula-gallery posts and their member attachments and recover the image's title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags emitted in the response, which then allows direct unauthenticated download of the original private image bytes.

• CWE-862

• https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/class-modula-meta.php#L142
• https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/class-modula-meta.php#L26
• https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/class-modula-meta.php#L50
• https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/social_meta.php#L8
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3697043%40modula-best-grid-gallery&new=3697043%40modula-best-grid-gallery
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a369dff6-feca-47cf-8511-dc75c4ffdd29?source=cve

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8934A Missing Authorization vulnerability in a GraphQL private A…6.9
• CVE-2026-8935The WP MAPS PRO WordPress plugin before 6.1.1 registers an u…9.8
• CVE-2026-8936Fixed a VM panic caused by unbounded recursion in the grpcfu…8.2
• CVE-2026-8938The auto making JSON-LD plugin for WordPress is vulnerable t…4.3
• CVE-2026-8939The Search Simple Fields plugin for WordPress is vulnerable …4.3
• CVE-2026-8940The WP Meta Sort Posts plugin for WordPress is vulnerable to…4.3
• CVE-2026-89407NumberInput.looksLikeValidNumber() in FasterXML jackson-core…7.5
• CVE-2026-8941The CDN Linker lite plugin for WordPress is vulnerable to Cr…4.3
• CVE-2026-89412The TranslatePress – Translate Multilingual sites with AI Tr…7.2
• CVE-2026-89413The Filter Gallery plugin for WordPress is vulnerable to aut…8.1
• CVE-2026-89418google-protobuf contains an unbounded recursion when parsing…8.7
• CVE-2026-8942The MetaMagic SEO Plugin plugin for WordPress is vulnerable …4.3