Modula Image Gallery Photo Grid Video Gallery
Monthly
Unauthenticated attackers can enumerate private and draft galleries and retrieve the original private image bytes from any WordPress site running the Modula Image Gallery - Photo Grid & Video Gallery plugin in versions up to and including 3.0.1. The plugin's Modula_Meta::add_metas() method is hooked to wp_head on every frontend request and builds Open Graph/Twitter meta tags from whatever post ID is supplied in the modula_gallery_id GET parameter, without verifying the gallery's post_status or the requester's read capability, so the response leaks the private gallery item's title, description, dimensions and original upload URL. Exploitation is remote and unauthenticated with no user interaction (CVSS 3.1 base 7.5, confidentiality-only impact), and gallery post IDs are sequential, making enumeration trivial; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Arbitrary file deletion in the Modula Image Gallery - Photo Grid & Video Gallery WordPress plugin, affecting all versions through 3.0.2, allows authenticated attackers with Author-level privileges or higher to delete arbitrary files on the underlying server by supplying a crafted file path to the upload_image function. The root cause is missing authorization (CWE-862) compounded by insufficient path validation; the plugin's restriction to wp-content/uploads does not act as an ownership boundary because every user attachment file resides within that tree, and Authors trivially satisfy the edit_post check on galleries they own. The vulnerability carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), reflecting network reachability, low complexity, and high integrity and availability impact, with no confidentiality impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated attackers can enumerate private and draft galleries and retrieve the original private image bytes from any WordPress site running the Modula Image Gallery - Photo Grid & Video Gallery plugin in versions up to and including 3.0.1. The plugin's Modula_Meta::add_metas() method is hooked to wp_head on every frontend request and builds Open Graph/Twitter meta tags from whatever post ID is supplied in the modula_gallery_id GET parameter, without verifying the gallery's post_status or the requester's read capability, so the response leaks the private gallery item's title, description, dimensions and original upload URL. Exploitation is remote and unauthenticated with no user interaction (CVSS 3.1 base 7.5, confidentiality-only impact), and gallery post IDs are sequential, making enumeration trivial; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Arbitrary file deletion in the Modula Image Gallery - Photo Grid & Video Gallery WordPress plugin, affecting all versions through 3.0.2, allows authenticated attackers with Author-level privileges or higher to delete arbitrary files on the underlying server by supplying a crafted file path to the upload_image function. The root cause is missing authorization (CWE-862) compounded by insufficient path validation; the plugin's restriction to wp-content/uploads does not act as an ownership boundary because every user attachment file resides within that tree, and Authors trivially satisfy the edit_post check on galleries they own. The vulnerability carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), reflecting network reachability, low complexity, and high integrity and availability impact, with no confidentiality impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.