CVE-2026-89413 farazfrank CVE debrief

Who should care

Defenders responsible for WordPress installations with the Filter Gallery plugin should assess exposure and prioritize updating the plugin to prevent exploitation. This includes operators managing WordPress environments, platform administrators, vulnerability management teams, and security teams that need to verify and update the plugin to prevent exploitation.

Why it matters

The Filter Gallery plugin for WordPress has an authorization bypass vulnerability, allowing authenticated attackers to delete arbitrary records. Defenders should prioritize verifying and updating the plugin to prevent exploitation.

• Authenticated attackers with subscriber-level access and above can delete arbitrary Filter Gallery records.
• The vulnerability allows for unauthorized deletion of filters, image mappings, settings, and details options.
• Defenders need to verify and update the Filter Gallery plugin to prevent exploitation.
• The authorization bypass requires omitting the nonce POST field entirely.

Technical summary

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete any arbitrary Filter Gallery records — including all associated filters, image mappings, settings, and details options — by supplying attacker-controlled gallery IDs.

Defensive priority

Defenders should prioritize verifying and updating the Filter Gallery plugin to prevent exploitation.

Recommended defensive actions

• Verify and update the Filter Gallery plugin to the latest version.
• Restrict access to the plugin's functionality to authorized users only.
• Monitor for suspicious activity related to the plugin.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is due to the plugin not properly verifying that a user is authorized to perform an action. The nonce bypass requires omitting the nonce POST field entirely rather than submitting an invalid value.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.