{"schema":"threatline.record/2","record":{"id":"CVE-2026-89406","aliases":[],"summary":"Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters","details":"The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the Modula_Meta::add_metas() function being hooked to wp_head on every frontend request and looking up any post via get_post( $_GET['modula_gallery_id'] ) without verifying the gallery's post_status or the requester's capability to read it — the gallery-side input guard is bugged (empty('modula_gallery_id') tests a nonempty string literal instead of the GET parameter, so it is always false), the only object validation is a post_type === 'modula-gallery' check, and no is_user_logged_in()/current_user_can('read_post', $gallery_id) check is performed. This makes it possible for unauthenticated attackers to enumerate private modula-gallery posts and their member attachments and recover the image's title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags emitted in the response, which then allows direct unauthenticated download of the original private image bytes.","categories":["Unclassified"],"product":"Modula Image Gallery – Photo Grid & Video Gallery","vendor":"wpchill","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-89406","source_modified_at":"2026-09-25T13:00:14.389Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Modula Image Gallery – Photo Grid & Video Gallery","vendor":"wpchill","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.0.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00394,"percentile":0.32441,"score_date":"2026-10-23"},"published_at":"2026-09-25T07:40:28.898Z","modified_at":"2026-09-25T13:00:14.389Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-89406","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-25T13:00:14.389Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89406","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a369dff6-feca-47cf-8511-dc75c4ffdd29?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/class-modula-meta.php#L142"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/class-modula-meta.php#L50"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/class-modula-meta.php#L26"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.1/includes/public/meta/social_meta.php#L8"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3697043%40modula-best-grid-gallery&new=3697043%40modula-best-grid-gallery"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-25T12:50:17.988203Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-25T13:00:14.389Z","content_hash":"6df81ce9b32f647ed40d9339df856087538aa319a01662ced4163214cfe26f17"}}