CVE-2026-89138 farazfrank CVE debrief

Who should care

Defenders responsible for WordPress installations with the Filter Gallery plugin should assess exposure and prioritize remediation. This includes administrators and security teams managing WordPress sites with this plugin.

Why it matters

The Filter Gallery plugin for WordPress has an authorization bypass vulnerability that allows authenticated attackers to modify posts and options. Defenders should verify the plugin version, review user access, and monitor for suspicious activity to mitigate this risk.

• Defenders need to verify the version of the Filter Gallery plugin in use and update to a patched version if necessary to prevent unauthorized modifications.
• Reviewing user access and permissions can help prevent exploitation of this vulnerability.
• Monitoring for suspicious activity related to post modifications and option changes can help detect potential attacks.
• Ensuring that WordPress sites with this plugin are properly configured and secured can help mitigate the risk of exploitation.

Technical summary

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary WordPress posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options.

Defensive priority

Defenders should prioritize verifying the version of the Filter Gallery plugin in use and ensuring that it is updated to a version that addresses this vulnerability. They should also review user access and permissions to prevent unauthorized modifications.

Recommended defensive actions

• Verify the version of the Filter Gallery plugin in use and update to a patched version if necessary.
• Review user access and permissions to prevent unauthorized modifications.
• Monitor for suspicious activity related to post modifications and option changes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The Filter Gallery plugin for WordPress has an authorization bypass vulnerability in all versions up to and including 1.1.4. This allows authenticated attackers with subscriber-level access and above to overwrite titles and content of arbitrary WordPress posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options. The vulnerability is due to the plugin not properly verifying that a user is authorized to perform an action. This information comes from the CVE Program and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.