What is the CVSS score of CVE-2026-39481?

CVE-2026-39481 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Modula Image Gallery are affected by CVE-2026-39481?

Modula Image Gallery WordPress plugin versions 2.14.18 and earlier contain a PHP object injection flaw exploitable by authenticated author-level users to achieve remote code execution.

How to fix or mitigate CVE-2026-39481?

Within 24 hours: Audit WordPress installations for Modula Image Gallery plugin presence and active version. Within 7 days: Either disable the plugin entirely or restrict author role membership to essential administrators only and enable account monitoring. Within 30 days: Monitor Patchstack advisory and plugin vendor channels for patch release; apply immediately upon availability or migrate to alternative image gallery solutions.

Modula Image Gallery CVE-2026-39481

EUVD-2026-36940 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-g62q-72r7-mfg9

PHP Deserialization Modula Image Gallery

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

WordPress Author role is a low-privileged content contributor (PR:L, not admin-level PR:H); reliable RCE depends on a usable POP gadget chain in the target stack, raising AC to High.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:28 vuln.today

DescriptionCVE.org

Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.

AnalysisAI

PHP Object Injection in the Modula Image Gallery WordPress plugin (versions ≤ 2.14.18) allows authenticated authors to trigger unsafe deserialization of attacker-controlled input, potentially leading to remote code execution, data tampering, or denial of service depending on available POP gadget chains in the WordPress environment. The flaw was disclosed by Patchstack and tracked as ENISA EUVD-2026-36940; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability is a CWE-502 Deserialization of Untrusted Data weakness in the wp_chill Modula Image Gallery plugin (CPE cpe:2.3:a:wp_chill:modula_image_gallery). PHP Object Injection occurs when user-supplied input is passed to PHP's unserialize() function without validation, allowing an attacker to instantiate arbitrary classes and invoke their magic methods (__wakeup, __destruct, __toString). In a WordPress context, the attacker leverages POP (Property-Oriented Programming) gadget chains present in WordPress core, other installed plugins, or bundled libraries to escalate the deserialization primitive into file writes, SQL execution, or remote code execution. The 'Author' qualifier in the description indicates the entry point is reachable by users holding the WordPress Author role or higher.

RemediationAI

Patch available per vendor advisory - upgrade Modula Image Gallery to a release newer than 2.14.18 as published on the WordPress.org plugin repository and referenced by Patchstack at https://patchstack.com/database/wordpress/plugin/modula-best-grid-gallery/vulnerability/wordpress-modula-image-gallery-plugin-2-14-18-php-object-injection-vulnerability. If immediate patching is not feasible, compensating controls include temporarily deactivating the Modula Image Gallery plugin (removes gallery functionality from the site), restricting the Author role to trusted users only and auditing existing Author accounts for unexpected credentials, enforcing strong passwords and 2FA on all Author-and-above accounts to prevent credential-based access to the vulnerable endpoint, and deploying a WAF rule (such as Patchstack's vPatch) to block requests containing serialized PHP object payloads to the plugin's endpoints - note that WAF rules can produce false positives against legitimate serialized data and may require tuning.