CVE-2026-105876: Missing Authorization in WP Chill Modula Image Gallery

This vulnerability in WP Chill's Modula Image Gallery plugin (modula-best-grid-gallery) is due to missing authorization controls, which permits an attacker to retrieve embedded sensitive data without proper permissions. The affected versions include all releases prior to 3.0.12. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and limited confidentiality impact. No known exploits are reported in the wild, and no vendor advisory or patch information is provided.

An attacker can remotely access embedded sensitive data without authorization, potentially exposing confidential information. The impact is limited to confidentiality loss; integrity and availability are not affected. No privilege or user interaction is required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin or disable it if possible to prevent unauthorized data access.