CVE-2026-89406 is a missing authorization vulnerability (CWE-862) in the Modula Image Gallery – Photo Grid & Video Gallery WordPress plugin up to version 3.0.1. The vulnerability arises because the add_metas() function is hooked to wp_head on every frontend request and retrieves posts based on the modula_gallery_id GET parameter without verifying the post's status or the requester's permissions. The input guard is faulty due to an incorrect empty() check on a string literal, and the only validation performed is a post_type check. No user authentication or capability checks are done, allowing unauthenticated attackers to enumerate private galleries and access metadata exposed via Open Graph and Twitter meta tags, which can be used to download the original private images directly.

An unauthenticated attacker can enumerate private galleries and access sensitive metadata and original image files that should be restricted. This leads to unauthorized disclosure of private gallery contents, violating confidentiality. The vulnerability does not impact integrity or availability but exposes private user content to public access.

No official patch or fix information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin or disable it if private galleries are used. Monitor vendor channels for updates addressing this authorization flaw.