This vulnerability, identified as CVE-2026-39481, affects the Modula Image Gallery plugin by WP Chill, specifically versions up to 2.14.18. It is caused by unsafe deserialization of untrusted data, leading to PHP Object Injection. The CVSS 3.1 base score is 7.2, indicating high severity, with network attack vector, low attack complexity, requiring high privileges, no user interaction, and impacts confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary PHP object injection attacks, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This could result in unauthorized data access, modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for unusual activity. Avoid using affected versions if possible.