CVE-2026-107659: CWE-862 Missing Authorization in wpchill Modula Image Gallery – Photo Grid & Video Gallery

CVE-2026-107659 describes a missing authorization vulnerability (CWE-862) in the Modula Image Gallery – Photo Grid & Video Gallery WordPress plugin up to version 3.0.11. The vulnerability arises because the core REST API endpoint /wp-json/wp/v2/modula-gallery/{id} exposes the modulaSettings field without redacting sensitive password protect credentials (username and plaintext password) for published galleries. While the plugin's own REST endpoint /wp-json/modula/v2/gallery/{id}/settings correctly redacts these credentials for unauthenticated users, the core endpoint registered with show_in_rest=true does not, allowing unauthenticated attackers to retrieve sensitive information.

An unauthenticated attacker can retrieve plaintext passwords and usernames for all published password-protected galleries, leading to sensitive information exposure. This compromises the confidentiality of protected galleries without requiring authentication, potentially allowing unauthorized access to restricted content.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable REST API endpoints or disable the plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.