https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 22:44:14 +0000 https://db.gcve.eu/vuln/cve-2026-107659 <p><strong>Affected:</strong> wpchill Modula Image Gallery – Photo Grid &amp; Video Gallery</p> <p>The Modula Image Gallery – Photo Grid &amp; Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the &#39;id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route&#39; parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin&#39;s own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.</p> <p><strong>Affected:</strong> wpchill Modula Image Gallery – Photo Grid &amp; Video Gallery</p> <p>The Modula Image Gallery – Photo Grid &amp; Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the &#39;id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route&#39; parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin&#39;s own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.</p> https://db.gcve.eu/vuln/cve-2026-107659