CVE-2026-89413 farazfrank CVE debrief

Who should care

Defenders responsible for WordPress installations with the Filter Gallery plugin should assess exposure and prioritize verification and remediation efforts. This includes operators managing WordPress environments, platform administrators, vulnerability management teams, and security teams that need to verify the presence of this vulnerability, restrict access to the plugin, and monitor for suspicious activity.

Why it matters

The Filter Gallery plugin for WordPress has an authorization bypass vulnerability, allowing authenticated attackers to delete arbitrary records. Defenders should prioritize verification and remediation efforts.

• Authenticated attackers with subscriber-level access and above can delete arbitrary Filter Gallery records.
• The vulnerability allows for unauthorized actions within the Filter Gallery plugin.
• Defenders need to verify the presence of this vulnerability in their WordPress installations.

Technical summary

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete any arbitrary Filter Gallery records — including all associated filters, image mappings, settings, and details options — by supplying attacker-controlled gallery IDs.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and restrict access to the Filter Gallery plugin to prevent unauthorized actions.

Recommended defensive actions

• Verify the presence of the Filter Gallery plugin in your WordPress installation and check if the version is 1.1.4 or earlier.
• Restrict access to the Filter Gallery plugin to prevent unauthorized actions.
• Monitor for suspicious activity related to the Filter Gallery plugin.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is due to the plugin not properly verifying that a user is authorized to perform an action. The nonce bypass requires omitting the nonce POST field entirely rather than submitting an invalid value.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.