Filter Gallery CVE-2026-89413

Requires an authenticated account with subscriber-level access or above on a WordPress site running the Filter Gallery plugin version <=1.1.4 - meaning sites that allow open user self-registration are most exposed. The delete action performs no ownership/capability verification, so any such user can target arbitrary gallery IDs. The nonce check is only evaded by omitting the nonce POST field entirely; submitting a present-but-invalid nonce is correctly rejected. No user interaction beyond the attacker's own request is needed, and the attack is fully remote over HTTP. The primary limiting factors are the requirement for a valid low-privilege account and the plugin's niche deployment.

The vendor CVSS of 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) is well-supported by the description: a network-reachable, low-complexity attack requiring only subscriber-level authentication (PR:L) that lets an attacker destroy any Filter Gallery record and its associated filters, image mappings, settings, and details options. The impact is purely destructive (C:N, I:H/A:H) - no data disclosure, but permanent loss of gallery data. No EPSS score, KEV listing, or weaponized POC is present in the input, so exploitation status is 'no public exploit identified at time of analysis'; however, the Wordfence advisory plus the exact vulnerable source lines (filter-gallery.php L1099/L1112/L1131) and the fix changeset 3695415 together amount to a reproduction recipe, lowering the barrier to exploit development. This is a genuine authorization/IDOR flaw rather than an inflated high-CVSS issue, but real-world priority is tempered by two factors: the affected plugin is niche, and exploitation requires an existing authenticated account (subscriber+), so risk concentrates on sites that permit open user registration. The 'Authentication Bypass' tag is misleading - this is a missing authorization check (CWE-862) exploited by an authenticated user, not an authentication bypass. The nonce weakness is real but secondary: it only functions when the nonce POST field is omitted entirely (a present-but-invalid nonce is correctly rejected), a CSRF-adjacent quirk rather than the core authz defect.

An attacker registers a low-privilege subscriber account on a WordPress site running Filter Gallery <=1.1.4 (or uses any existing account), then sends a crafted POST to the delete action supplying arbitrary attacker-chosen gallery IDs while omitting the nonce field entirely to sidestep the nonce check. The server deletes the targeted galleries along with all associated filters, image mappings, settings, and details, causing permanent data loss. No public exploit is identified, but Wordfence's writeup and the public source/changeset make reproduction straightforward.