CVE-2026-90978 Filter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin...

CVE-2026-90978

The Filter Gallery WordPress plugin before version 1.1.5 is vulnerable due to a fail-open nonce check on several of its AJAX handlers: when the nonce field is omitted, verification passes, and no additional capability check is applied. This allows low-privileged users (Subscriber and above) to ov...