CVE-2026-89413: Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameter
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete any arbitrary Filter Gallery records — including all associated filters, image mappings, settings, and details options — by supplying attacker-controlled gallery IDs. The nonce bypass requires omitting the nonce POST field entirely rather than submitting an invalid value, as a present-but-invalid nonce is correctly rejected.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. No user interaction is required.
What does an attacker need to send for the authorization and nonce checks to be bypassed?
The attacker needs to supply a chosen gallery ID through the ufg_gallery_id parameter. The nonce POST field must be omitted entirely; a nonce that is present but invalid is rejected.
What can be deleted through a successful exploit?
An attacker can delete arbitrary Filter Gallery records. This includes associated filters, image mappings, settings, and details options.
Which plugin versions are affected?
All Filter Gallery versions up to and including 1.1.4 are affected.