CVE-2026-92713 wpchill CVE debrief

Who should care

Defenders responsible for WordPress installations with the Modula Image Gallery plugin should assess exposure and apply patches. This includes administrators, security teams, and developers who manage WordPress sites.

Why it matters

CVE-2026-92713 is a high-severity vulnerability in the Modula Image Gallery plugin for WordPress, allowing authenticated attackers to delete arbitrary files on the server. Defenders should prioritize verifying exposure and applying patches to prevent potential data loss, server compromise, or disruption to website functionality.

• Potential for significant data loss or corruption due to arbitrary file deletion.
• Increased risk of server compromise or unauthorized access.
• Potential disruption to website functionality or availability.
• Need for verification of exposure and application of patches.

Technical summary

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_image function across all versions up to, and including, 3.0.2. This allows authenticated attackers with author-level access and above to delete arbitrary files on the server. The vulnerability has a high CVSS score of 8.1, indicating a significant risk. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and Authors trivially satisfy the edit_post check on their own galleries. The vulnerability can lead to potential data loss, server compromise, or disruption to website functionality.

Defensive priority

Defenders should prioritize verifying exposure and applying patches due to the high CVSS score of 8.1 and the potential for significant impact.

Recommended defensive actions

• Verify the version of the Modula Image Gallery plugin and update to a patched version if necessary.
• Restrict access to the upload functionality to prevent unauthorized file deletions.
• Monitor server logs for suspicious file deletion activities.
• Implement additional security measures such as file system access controls and monitoring.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability allows for arbitrary file deletion due to insufficient file path validation. The path restriction to wp-content/uploads is not an effective ownership boundary. Authors can satisfy the edit_post check on their own galleries.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.