https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 09:33:32 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-89406 <p>The Modula Image Gallery – Photo Grid &amp; Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the Modula_Meta::add_metas() function being hooked to wp_head on every frontend request and looking up any post via get_post( $_GET[&#39;modula_gallery_id&#39;] ) without verifying the gallery&#39;s post_status or the requester&#39;s capability to read it — the gallery-side input guard is bugged (empty(&#39;modula_gallery_id&#39;) tests a nonempty string literal instead of the GET parameter, so it is always false), the only object validation is a post_type === &#39;modula-gallery&#39; check, and no is_user_logged_in()/current_user_can(&#39;read_post&#39;, $gallery_id) check is performed. This makes it possible for unauthenticated attackers to enumerate private modula-gallery posts and their member attachments and recover the image&#39;s title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags emitted in the response, which then allows direct unauthenticated download of the original private image bytes.</p> <p>The Modula Image Gallery – Photo Grid &amp; Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the Modula_Meta::add_metas() function being hooked to wp_head on every frontend request and looking up any post via get_post( $_GET[&#39;modula_gallery_id&#39;] ) without verifying the gallery&#39;s post_status or the requester&#39;s capability to read it — the gallery-side input guard is bugged (empty(&#39;modula_gallery_id&#39;) tests a nonempty string literal instead of the GET parameter, so it is always false), the only object validation is a post_type === &#39;modula-gallery&#39; check, and no is_user_logged_in()/current_user_can(&#39;read_post&#39;, $gallery_id) check is performed. This makes it possible for unauthenticated attackers to enumerate private modula-gallery posts and their member attachments and recover the image&#39;s title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags emitted in the response, which then allows direct unauthenticated download of the original private image bytes.</p> https://db.gcve.eu/vuln/fkie_cve-2026-89406 https://db.gcve.eu/vuln/ghsa-vpwx-33j2-2p7h <p>The Modula Image Gallery – Photo Grid &amp; Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the Modula_Meta::add_metas() function being hooked to wp_head on every frontend request and looking up any post via get_post( $_GET[&#39;modula_gallery_id&#39;] ) without verifying the gallery&#39;s post_status or the requester&#39;s capability to read it — the gallery-side input guard is bugged (empty(&#39;modula_gallery_id&#39;) tests a nonempty string literal instead of the GET parameter, so it is always false), the only object validation is a post_type === &#39;modula-gallery&#39; check, and no is_user_logged_in()/current_user_can(&#39;read_post&#39;, $gallery_id) check is performed. This makes it possible for unauthenticated attackers to enumerate private modula-gallery posts and their member attachments and recover the image&#39;s title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags emitted in the response, which then allows direct unauthenticated download of the original private image bytes.</p> <p>The Modula Image Gallery – Photo Grid &amp; Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the Modula_Meta::add_metas() function being hooked to wp_head on every frontend request and looking up any post via get_post( $_GET[&#39;modula_gallery_id&#39;] ) without verifying the gallery&#39;s post_status or the requester&#39;s capability to read it — the gallery-side input guard is bugged (empty(&#39;modula_gallery_id&#39;) tests a nonempty string literal instead of the GET parameter, so it is always false), the only object validation is a post_type === &#39;modula-gallery&#39; check, and no is_user_logged_in()/current_user_can(&#39;read_post&#39;, $gallery_id) check is performed. This makes it possible for unauthenticated attackers to enumerate private modula-gallery posts and their member attachments and recover the image&#39;s title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags emitted in the response, which then allows direct unauthenticated download of the original private image bytes.</p> https://db.gcve.eu/vuln/ghsa-vpwx-33j2-2p7h