Authorization Bypass in Modula Image Gallery Plugin for WordPress

CVE-2026-1254

What is CVE-2026-1254?

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress exhibits an authorization bypass flaw that affects all versions up to and including 2.13.6. This vulnerability arises from the plugin's lack of adequate checks to confirm user permissions for modifying specific posts through the REST API. As a result, authenticated users with contributor-level access or higher can manipulate arbitrary posts by supplying their IDs in the modulaImages field while editing a gallery, leading to unintended alterations of post titles, excerpts, and contents.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References