CVE-2026-89406: Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas() function being hooked to wphead on every frontend request and looking up any post via getpost( $GET['modulagalleryid'] ) without verifying the gallery's poststatus or the requester's capability to read it — the gallery-side input guard is bugged (empty('modulagalleryid') tests a nonempty string literal instead of the GET parameter, so it is always false), the only object validation is a posttype === 'modula-gallery' check, and no isuserloggedin()/currentusercan('readpost', $galleryid) check is performed. This makes it possible for unauthenticated attackers to enumerate private modula-gallery posts and their member attachments and recover the image's title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags emitted in the response, which then allows direct unauthenticated download of the original private image bytes.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using the affected plugin versions with private posts of the modula-gallery post type are exposed. Any unauthenticated remote visitor can target those galleries; no account or special privileges are required.
What does an attacker need to exploit it?
An attacker needs the ID of a private modula-gallery post and an image ID associated with that gallery. They can use the modula_gallery_id and modula_image_id request parameters to obtain image metadata and the original upload URL.
Are private gallery images directly downloadable after disclosure?
Yes. The response exposes the original image upload URL through Open Graph and Twitter meta tags, allowing an unauthenticated attacker to download the original private image bytes.
How can I determine whether sensitive information may already be exposed?
Review whether the site has private modula-gallery posts and whether their attached images contain sensitive content. The vulnerable behavior occurs on frontend requests and exposes image titles, descriptions, dimensions, and original upload URLs for targeted private galleries.