CVE-2026-107659

7.5High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-862

Impact

Unauthenticated remote attackers can read the plaintext usernames and passwords for all password-protected galleries. They only need network access to the public WordPress REST API endpoints.

Root cause

The core custom post type REST endpoint exposes the full modulaSettings object without applying the password redaction function used by the plugin's custom endpoint.

Affected systems

Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress up to, and including, 3.0.11

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade Modula to a version newer than 3.0.11. As an interim workaround, block unauthenticated access to the '/wp-json/wp/v2/modula-gallery' path at your reverse proxy or web application firewall.

shell

$ wp plugin update modula-best-grid-gallery

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-107659