CVE-2026-89406

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...

CVE-2026-89406

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to and including 3.0.1 . The root cause is located in the Modula_Meta::add_metas() function, which is hooked to wp_head and fetches posts ...

EUVD-2026-86602

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...

CVE-2026-89406 Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...

CVE-2026-89406 Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...

CVE-2026-89406: Missing Authorization

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...