CVE-2026-1254

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.6. This is due to the plugin not properly verifying that a user is authorized to modify specific posts before updating them via the REST API. This makes it possible for authenticated attackers, with contributor level access and above, to update the title, excerpt, and content of arbitrary posts by passing post IDs in the modulaImages field when editing a gallery.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/changeset/3447757/modula-best-grid-gallery/trunk/includes/admin/class-modula-cpt.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/9b86d26e-cda0-4558-9967-3ec6f5eff510?source=cve

Configurations

No configuration.

History

No history.

Information

Published : 2026-02-14 09:16

Updated : 2026-06-17 10:15

NVD link : CVE-2026-1254

Mitre link : CVE-2026-1254

CVE.ORG link : CVE-2026-1254

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-1254", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1254", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T15:36:26.080595Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "wpchill", "product": "Modula Image Gallery \u2013 Photo Grid & Video Gallery", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.13.6"}], "defaultStatus": "unaffected"}]}], "published": "2026-02-14T09:16:12.020", "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3447757/modula-best-grid-gallery/trunk/includes/admin/class-modula-cpt.php", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9b86d26e-cda0-4558-9967-3ec6f5eff510?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The Modula Image Gallery \u2013 Photo Grid & Video Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.6. This is due to the plugin not properly verifying that a user is authorized to modify specific posts before updating them via the REST API. This makes it possible for authenticated attackers, with contributor level access and above, to update the title, excerpt, and content of arbitrary posts by passing post IDs in the modulaImages field when editing a gallery."}, {"lang": "es", "value": "El plugin Modula Image Gallery \u2013 Photo Grid & Video Gallery para WordPress es vulnerable a una omisi\u00f3n de autorizaci\u00f3n en todas las versiones hasta la 2.13.6, inclusive. Esto se debe a que el plugin no verifica correctamente que un usuario est\u00e1 autorizado para modificar publicaciones espec\u00edficas antes de actualizarlas a trav\u00e9s de la API REST. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, actualicen el t\u00edtulo, el extracto y el contenido de publicaciones arbitrarias al pasar IDs de publicaciones en el campo modulaImages al editar una galer\u00eda."}], "lastModified": "2026-06-17T10:15:24.260", "sourceIdentifier": "security@wordfence.com"}