CVE-2026-92713: Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and Authors trivially satisfy the editpost check on their own galleries.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with the Author role or a higher-privileged role can exploit it. The attacker can satisfy the relevant edit_post check using a gallery they own.
What files are at risk of deletion?
Files within the wp-content/uploads tree are at risk. This includes other users' attachment files, because the uploads directory is not an effective ownership boundary.
Does exploitation require user interaction or complex attack conditions?
No user interaction is required, and the attack complexity is low. The attacker does need an authenticated Author-level or higher account.
What is the impact if exploitation succeeds?
An attacker can delete arbitrary non-PHP files on the server within the affected path scope. This can cause integrity loss and service disruption through deletion of uploaded assets.