CVE-2026-89138: Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX Action
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary WordPress posts, write the wpattachmentimagealt meta key on arbitrary posts, and create or overwrite arbitrary ufggallery options.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Filter Gallery (WordPress plugin)to a version that resolves this vulnerability.Fixed in 1.1.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Subscriber-level access or higher. No user interaction is required.
Which installations are affected?
All Filter Gallery versions through 1.1.4 are affected. The provided information does not identify a fixed version or any configuration prerequisite.
What changes can an attacker make?
A qualifying low-privileged user can overwrite the title and content of arbitrary WordPress posts, set the _wp_attachment_image_alt metadata key on arbitrary posts, and create or overwrite ufg_gallery_* options.
How can administrators assess potential impact?
Review WordPress posts for unexpected title or content changes, inspect _wp_attachment_image_alt metadata for unauthorized values, and check ufg_gallery_* options for unexpected creation or modification. Also review whether untrusted users have Subscriber or higher accounts.