What the vulnerability does
01Description
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.6. This is due to the plugin not properly verifying that a user is authorized to modify specific posts before updating them via the REST API. This makes it possible for authenticated attackers, with contributor level access and above, to update the title, excerpt, and content of arbitrary posts by passing post IDs in the modulaImages field when editing a gallery.
Explanation of Vulnerability in Simple Terms
02Summary
The Modula Image Gallery plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to modify gallery data they should not have access to. The vulnerability affects versions up to 2.13.6. An attacker with a basic user account can alter gallery content without proper permission checks, potentially defacing or corrupting image galleries on the site.
What an attacker can do
03Attacker Capabilities
Modify gallery content and settings without proper authorization.
Potential impact on your site
04Site Impact
Galleries can be altered or corrupted by low-privilege users, risking data integrity and site appearance.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., Subscriber or Contributor).
Key dates
06Disclosure timeline
February 14, 2026
CVE published
April 8, 2026
Record updated
