CVE-2026-107659 wpchill CVE debrief

Who should care

WordPress administrators and defenders responsible for managing Modula Image Gallery installations should assess exposure and prioritize updates or compensating controls to protect against unauthorized access to gallery settings.

Why it matters

CVE-2026-107659 allows unauthenticated attackers to access sensitive information, including plaintext passwords and usernames, for published galleries in the Modula Image Gallery plugin for WordPress. This vulnerability requires immediate attention from WordPress administrators and defenders to prevent unauthorized access and potential data breaches.

• Defenders must verify exposure of Modula Image Gallery installations to unauthorized access.
• Immediate updates or compensating controls are necessary to protect gallery settings.
• Monitoring for unauthorized access to gallery passwords and usernames is required.

Technical summary

The Modula Image Gallery plugin for WordPress, up to version 3.0.11, exposes sensitive information through its /wp-json/wp/v2/modula-gallery/{id} endpoint. This allows unauthenticated attackers to retrieve plaintext passwords and usernames for published galleries by accessing the modulaSettings REST field. The plugin's CPT registration with show_in_rest=true enables this exposure. While the /wp-json/modula/v2/gallery/{id}/settings endpoint properly redacts passwords via the redact_settings_for_public() function, the core /wp-json/wp/v2/modula-gallery path lacks equivalent protection.

Defensive priority

Defenders should prioritize verifying exposure of Modula Image Gallery installations, especially versions up to 3.0.11, and assess the need for immediate updates or compensating controls.

Recommended defensive actions

• Verify and update Modula Image Gallery to a version that addresses the sensitive information exposure vulnerability.
• Restrict access to the /wp-json/wp/v2/modula-gallery endpoint to authenticated users only.
• Monitor for unauthorized access to gallery settings and passwords.
• Implement additional logging and monitoring to detect potential exploitation attempts.
• Conduct a thorough review of existing gallery settings and passwords for potential exposure.
• Consider temporarily restricting access to the Modula Image Gallery plugin until a patch is applied.
• Review and update incident response plans to address potential data breaches.

Evidence notes

The vulnerability is confirmed in version 3.0.11 of the Modula Image Gallery plugin. The /wp-json/modula/v2/gallery/{id}/settings endpoint properly redacts passwords, but the /wp-json/wp/v2/modula-gallery path does not.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.