{
 "id": "WPSEC-2026-1282",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1282/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1282/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1282/index.md",
 "title": "Modula Image Gallery <= 3.0.13 - Authenticated (Contributor+) Missing Authorization to Gallery Duplication",
 "description": "The Modula Image Gallery plugin for WordPress is vulnerable to unauthorized gallery duplication via the 'modula_duplicate_gallery_save_as_new_post' admin action in all versions up to, and including, 3.0.13, due to a missing capability check in the modula_duplicate_gallery_save_as_new_post() function. The function only verifies a per-gallery nonce, and the gallery list row actions print that nonce for every listed gallery, whether or not the user can edit it. This makes it possible for authenticated attackers, with contributor-level access and above, to duplicate galleries they are not permitted to edit, such as other users' drafts or password-protected galleries. The attacker then owns a copy holding the original's images, settings and post password, which they can view.",
 "plugin": {
  "slug": "modula-best-grid-gallery",
  "name": "Modula Image Gallery",
  "full_name": "Modula Image Gallery – Photo Grid & Video Gallery",
  "wordpress_org": "https://wordpress.org/plugins/modula-best-grid-gallery/",
  "advisories_url": "https://wpsec.com/vuln/plugin/modula-best-grid-gallery/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/modula-best-grid-gallery"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.0.14",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.0.14"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.0.14",
 "remediation": "Update to 3.0.14 or later.",
 "fix_released": "2026-10-20T07:55:54+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:34:13.658623+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1282/",
  "https://plugins.svn.wordpress.org/modula-best-grid-gallery/tags/3.0.14/",
  "https://wordpress.org/plugins/modula-best-grid-gallery/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/modula-best-grid-gallery",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-21"
 }
}