The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redactsettingsforpublic(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by showinrest=true CPT registration.

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas() function being hooked to wphead on every frontend request and looking up any post via getpost( $GET['modulagalleryid'] ) without verifying the gallery's poststatus or the requester's capability to read it — the gallery-side input guard is bugged (empty('modulagalleryid') tests a nonempty string literal instead of the GET parameter, so it is always false), the only object validation is a posttype === 'modula-gallery' check, and no isuserloggedin()/currentusercan('readpost', $galleryid) check is performed. This makes it possible for unauthenticated attackers to enumerate private modula-gallery posts and their member attachments and recover the image's title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags emitted in the response, which then allows direct unauthenticated download of the original private image bytes.

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and Authors trivially satisfy the editpost check on their own galleries.