Modula Image Gallery <= 3.0.13 - Authenticated (Contributor+) Missing Authorization to Gallery Duplication
- ID
- WPSEC-2026-1282
- Plugin
- Modula Image Gallery – Photo Grid & Video Gallery (modula-best-grid-gallery)
- Affected
- all versions before 3.0.14
- Remediation
- Update to 3.0.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-21
- Attack surface
- Modula Image Gallery on WPSec AttackSurface
- Fix released
- Published
Description
The Modula Image Gallery plugin for WordPress is vulnerable to unauthorized gallery duplication via the 'modula_duplicate_gallery_save_as_new_post' admin action in all versions up to, and including, 3.0.13, due to a missing capability check in the modula_duplicate_gallery_save_as_new_post() function. The function only verifies a per-gallery nonce, and the gallery list row actions print that nonce for every listed gallery, whether or not the user can edit it. This makes it possible for authenticated attackers, with contributor-level access and above, to duplicate galleries they are not permitted to edit, such as other users' drafts or password-protected galleries. The attacker then owns a copy holding the original's images, settings and post password, which they can view.
References
- https://wpsec.com/vuln/WPSEC-2026-1282/
- https://plugins.svn.wordpress.org/modula-best-grid-gallery/tags/3.0.14/
- https://wordpress.org/plugins/modula-best-grid-gallery/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS