# Modula Image Gallery <= 3.0.13 - Authenticated (Contributor+) Missing Authorization to Gallery Duplication

- **ID:** WPSEC-2026-1282
- **Plugin:** Modula Image Gallery – Photo Grid & Video Gallery (`modula-best-grid-gallery`), https://wordpress.org/plugins/modula-best-grid-gallery/
- **Affected versions:** all versions before 3.0.14
- **Fixed in:** 3.0.14 (Update to 3.0.14 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/modula-best-grid-gallery
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1282/

## Description

The Modula Image Gallery plugin for WordPress is vulnerable to unauthorized gallery duplication via the 'modula_duplicate_gallery_save_as_new_post' admin action in all versions up to, and including, 3.0.13, due to a missing capability check in the modula_duplicate_gallery_save_as_new_post() function. The function only verifies a per-gallery nonce, and the gallery list row actions print that nonce for every listed gallery, whether or not the user can edit it. This makes it possible for authenticated attackers, with contributor-level access and above, to duplicate galleries they are not permitted to edit, such as other users' drafts or password-protected galleries. The attacker then owns a copy holding the original's images, settings and post password, which they can view.

## References

- https://wpsec.com/vuln/WPSEC-2026-1282/
- https://plugins.svn.wordpress.org/modula-best-grid-gallery/tags/3.0.14/
- https://wordpress.org/plugins/modula-best-grid-gallery/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1282/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.