CVE-2026-92713 is a missing authorization vulnerability (CWE-862) in the Modula Image Gallery – Photo Grid & Video Gallery WordPress plugin. The flaw exists in the upload_image function where file path validation is insufficient, allowing authenticated users with author-level privileges or higher to delete arbitrary files on the server. The plugin attempts to restrict deletions to the wp-content/uploads directory, but this is ineffective because all user attachments reside there and authors can edit their own posts, enabling them to delete files beyond their intended scope. This vulnerability affects all versions up to and including 3.0.2.

An attacker with author-level access or higher can delete arbitrary files on the server, potentially disrupting website functionality or causing denial of service. The vulnerability does not allow direct confidentiality breaches but impacts integrity and availability. The CVSS 3.1 score is 8.1 (High), reflecting network attack vector, low attack complexity, privileges required at the author level, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict author-level access carefully and consider disabling or limiting use of the Modula Image Gallery plugin. Review file permissions and backups to recover from potential file deletions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.