What is the CVSS score of CVE-2026-105876?

CVE-2026-105876 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Modula Image Gallery CVE-2026-105876

EUVD-2026-94258 MEDIUM

Missing Authorization (CWE-862)

2026-10-07 Patchstack

GHSA-5mwf-w876-wqg7

WordPress Authentication Bypass Information Disclosure Modula Image Gallery Wordpress Plugin Wp Chill

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Missing authorization on a network endpoint needing no auth or interaction gives AV:N/AC:L/PR:N/UI:N; only limited data leaks, so C:L and I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 09:51 vuln.today

CVE Published

Oct 07, 2026 - 09:16 cve.org

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11.

AnalysisAI

Unauthenticated information disclosure in the WP Chill Modula Image Gallery WordPress plugin (modula-best-grid-gallery) through version 3.0.11 lets remote attackers retrieve embedded sensitive data from a site without logging in or triggering any user interaction. The missing authorization check (CWE-862) affects an exposed plugin route, but impact is limited to low-confidentiality read access - there is no ability to modify content or execute code. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the Modula Image Gallery plugin (modula-best-grid-gallery) to be installed and active at version 3.0.11 or earlier on a network-reachable WordPress site. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a moderate, not high, priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch version is identified in the available data, so the first step is to consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/modula-best-grid-gallery/vulnerability/wordpress-modula-image-gallery-plugin-3-0-11-sensitive-data-exposure-vulnerability?_s_id=cve) and the plugin's WordPress.org changelog to determine whether a release later than 3.0.11 contains a fix and, if so, upgrade to that exact build. … Detailed patch versions, workarounds, and compensating controls in full report.