CVE-2026-89413 is an authorization bypass vulnerability (CWE-862) in the Filter Gallery plugin for WordPress versions up to and including 1.1.4. The plugin fails to properly verify user authorization when performing delete actions on Filter Gallery records. Authenticated attackers with subscriber-level privileges or above can delete arbitrary records by supplying attacker-controlled gallery IDs. The nonce protection can be bypassed by omitting the nonce POST field entirely, as invalid nonce values are correctly rejected. This vulnerability allows unauthorized deletion of filters, image mappings, settings, and related options.

An attacker with subscriber-level access or higher can delete any Filter Gallery records, including all associated filters, image mappings, settings, and details options. This leads to integrity and availability impacts on the affected plugin data but does not affect confidentiality. The CVSS 3.1 score is 8.1 (high severity) reflecting network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity and availability impact.

No official patch or fix is currently available as per the provided data. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict subscriber-level access where possible and consider disabling the Filter Gallery plugin if unauthorized deletion risk is unacceptable. Since the nonce bypass requires omitting the nonce field, ensuring strict validation of request parameters and implementing additional authorization checks may help mitigate risk temporarily.