CVE-2026-90978

The Filter Gallery WordPress plugin (versions 1.1.2–1.1.4 ) contains a fail-open nonce check on several of its AJAX handlers: when the nonce field is omitted entirely, the check is skipped, and no capability check is applied. This allows Subscriber-level or higher users to overwrite the content o...