Modula Image Gallery CVE-2026-107659

No special attacker-side conditions - remote unauthenticated GET requests to the default-exposed core REST route /wp-json/wp/v2/modula-gallery/{id} (enabled automatically by the plugin's show_in_rest=true CPT registration) of Modula Image Gallery ≤3.0.11 return the unredacted modulaSettings field. The one meaningful limiting factor is target-side: the sensitive plaintext password and username are only present for galleries where the site operator has enabled the Password Protect feature; galleries without it expose only non-credential settings. No authentication, user interaction, or non-default configuration is required on the attacker's side.

This is a genuine, high-confidence priority for any site running Modula with the Password Protect feature, though the real-world blast radius is narrower than the 7.5/CVSS-High headline suggests. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is internally consistent with the description: the core REST route /wp-json/wp/v2/modula-gallery/{id} is exposed by show_in_rest=true and returns the modulaSettings field unredacted to anyone, so exploitation is remote, unauthenticated, low-complexity, and requires no user interaction - all signals agree. The impact is confidentiality-only (I:N/A:N), limited to leaking the plaintext Password Protect password and username for published galleries; it is not RCE or a privilege escalation on the host, so C:H here reflects credential exposure rather than full-system compromise. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of these signals does not lower the fix priority given how trivially the data is retrievable (a single unauthenticated GET), but it does suggest the issue is not yet under mass exploitation. A key limiting factor to weigh: the password/username leak only matters for galleries that actually have Password Protect configured - sites that never enabled that feature expose only non-sensitive gallery metadata. Patch urgency is high for the affected feature; broad panic is not warranted absent exploitation evidence.

An unauthenticated attacker enumerates a target WordPress site and issues a simple GET request to /wp-json/wp/v2/modula-gallery/{id} (or the collection route with no id), reading the modulaSettings REST field directly from the response. Because the core CPT route applies no redaction - unlike the plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint which calls redact_settings_for_public() - the plaintext Password Protect password and username for every published gallery are returned in the clear. No public exploit was identified at time of analysis, but the attack requires only a browser or curl and no tooling.