Description

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the Modula_Meta::add_metas() function being hooked to wp_head on every frontend request and looking up any post via get_post( $_GET['modula_gallery_id'] ) without verifying the gallery's post_status or the requester's capability to read it — the gallery-side input guard is bugged (empty('modula_gallery_id') tests a nonempty string literal instead of the GET parameter, so it is always false), the only object validation is a post_type === 'modula-gallery' check, and no is_user_logged_in()/current_user_can('read_post', $gallery_id) check is performed. This makes it possible for unauthenticated attackers to enumerate private modula-gallery posts and their member attachments and recover the image's title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags emitted in the response, which then allows direct unauthenticated download of the original private image bytes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-25T08:16:40.803Z",
  "pubdate": "2026-09-25T08:16:40.803Z",
  "executiveSummary": "The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress suffers from an Improper Access Control vulnerability affecting versions up to and including 3.0.1.\nThe vulnerability resides within the Modula_Meta::add_metas() function, which fails to enforce authorization checks when processing frontend requests.\nAn unauthenticated attacker can leverage this flaw to enumerate and access metadata associated with private 'modula-gallery' posts.\nBy manipulating the 'modula_gallery_id' parameter, an attacker can force the application to disclose sensitive information, including image titles, descriptions, dimensions, and direct URLs to original private image files via Open Graph and Twitter meta tags.\nThis vulnerability poses a significant risk as it allows unauthorized disclosure of restricted content, bypassing standard WordPress visibility and access control mechanisms.\nSuccessful exploitation requires no prior authentication or specific user privileges, making it highly accessible for automated scanning and mass exploitation by malicious actors.\nImpact includes the exposure of confidential gallery assets and potential sensitive metadata leakage.",
  "technicalDetails": "The root cause of the vulnerability is located in the Modula_Meta::add_metas() function, which is registered as a hook to 'wp_head' and executes on every frontend request.\nThe function attempts to retrieve gallery information by passing the 'modula_gallery_id' parameter directly from the $_GET superglobal into the get_post() function. Critically, the implementation lacks an authorization verification mechanism; it fails to check if the requester is authenticated or possesses the necessary capabilities to view the specific post.\nA logical flaw in the input validation further exacerbates the issue: the conditional guard designed to check for the presence of the 'modula_gallery_id' parameter uses an erroneous check against a non-empty string literal, ensuring the check always evaluates to false regardless of the provided GET parameter.\nThe only validation performed by the code is a superficial check ensuring that the retrieved post object's 'post_type' attribute is equal to 'modula-gallery'. However, the code completely ignores the 'post_status' of the gallery, allowing the retrieval of galleries set to 'private' or 'draft' status.\nThe attack flow proceeds as follows: 1. An attacker identifies the target WordPress instance using the Modula Image Gallery plugin. 2. The attacker performs an enumeration process by injecting varying integer values into the 'modula_gallery_id' GET parameter in the URL. 3. Upon finding a valid ID, the server processes the request and populates the document header with Open Graph and Twitter meta tags derived from the private post's metadata. 4. The attacker parses the HTTP response to extract sensitive information such as the image title, description, and the direct link to the original high-resolution image file. 5. The attacker directly accesses the retrieved URLs to download private image bytes, bypassing all WordPress access controls.\nThis vulnerability exposes the internal structure of gallery posts and allows for mass harvesting of images that were intended to remain private, effectively subverting the visibility settings of the WordPress gallery management system."
}