CVE-2026-90978: Filter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check
The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin before 1.1.5's stored gallery options.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with a low-privileged account, including a Subscriber-level account, can exploit it. No higher WordPress capability check is applied by the affected AJAX handlers.
What does an attacker need to do to bypass the nonce protection?
The attacker can omit the nonce field from requests to the affected AJAX handlers. In affected versions, the handlers fail open when that field is absent rather than rejecting the request.
What impact should administrators investigate?
An attacker may overwrite the content of arbitrary posts and delete stored Filter Gallery gallery options. Review post content for unauthorized changes and check whether the plugin's gallery configuration or options have been removed.
Which installations are affected?
Filter Gallery versions before 1.1.5 are affected. Installations where untrusted or low-privileged users can authenticate to WordPress have a direct exposure path.