CVE-2026-107659: Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redactsettingsforpublic(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by showinrest=true CPT registration.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. No account, user interaction, or special privileges are required.
Which galleries are exposed?
Every published gallery is affected because its modulaSettings REST field can expose the plaintext Password Protect password and username. The affected path is the core WordPress REST endpoint /wp-json/wp/v2/modula-gallery/{id}; the collection route can also be queried without specifying an individual ID.
Does the plugin's gallery settings API protect against this exposure?
The plugin-specific /wp-json/modula/v2/gallery/{id}/settings endpoint redacts passwords for unauthenticated callers. That protection does not apply to the core WordPress REST route because the modula-gallery custom post type is registered with REST exposure enabled.
How can I check whether my site is already exposed?
Request a published gallery through /wp-json/wp/v2/modula-gallery/{id} and inspect the modulaSettings field. If it contains a plaintext Password Protect password or username for an unauthenticated request, the gallery information is exposed.