Sensitive Information Exposure in Modula Image Gallery Plugin by WordPress

CVE-2026-107659

What is CVE-2026-107659?

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is exposed to a vulnerability that allows unauthorized users to access sensitive information. This occurs through the REST API, where the 'id' parameter can be exploited to retrieve plaintext credentials, including the Password Protect password and username for all published galleries. Although the plugin includes a safeguard that properly redacts sensitive data in its settings endpoint for authenticated users, it fails to do so on the main gallery path. As a result, malicious actors can extract critical data from the modulaSettings REST field, potentially leading to unauthorized access and data leakage.

References