CVE-2026-107659: Modula Gallery Information Disclosure

CVE-2026-107659 Overview

CVE-2026-107659 affects the Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress in all versions up to and including 3.0.11. The vulnerability allows unauthenticated attackers to retrieve plaintext Password Protect credentials for every published gallery through the WordPress core REST API. The flaw exists because the plugin registers its custom post type with show_in_rest=true without applying the redaction logic used by its own plugin-specific endpoint. Attackers can query /wp-json/wp/v2/modula-gallery/{id} or the collection route to extract the modulaSettings field, which contains the gallery password and username in cleartext.

Critical Impact
Unauthenticated remote attackers can harvest plaintext passwords and usernames protecting every published Modula gallery on affected WordPress sites.

Affected Products

Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress
All versions up to and including 3.0.11
WordPress sites exposing the core REST API with the plugin installed

Discovery Timeline

2026-10-16 - CVE-2026-107659 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-107659

Vulnerability Analysis

The vulnerability is an information exposure flaw classified under CWE-862: Missing Authorization. The Modula plugin stores Password Protect credentials inside gallery post metadata serialized into a modulaSettings field. The plugin exposes gallery data through two REST paths: its namespaced endpoint at /wp-json/modula/v2/gallery/{id}/settings and the WordPress core endpoint at /wp-json/wp/v2/modula-gallery/{id} created by registering the custom post type (CPT) with show_in_rest=true.

The namespaced endpoint invokes redact_settings_for_public() to strip the password before returning results to unauthenticated callers. The core WordPress REST path performs no equivalent redaction. Any attacker can issue an unauthenticated GET request to the core route and receive the full modulaSettings object, including the gallery password and username in plaintext.

Root Cause

The root cause is inconsistent authorization enforcement across REST endpoints exposing the same resource. The plugin's CPT registration at class-modula-cpt.php line 141 enables show_in_rest without supplying a sanitization callback or prepare_callback that redacts sensitive meta. Secret material is stored alongside non-sensitive configuration in the same meta field, and no field-level authorization check gates its exposure.

Attack Vector

Exploitation requires no authentication, no user interaction, and no special privileges. An attacker enumerates published gallery IDs or queries the collection route /wp-json/wp/v2/modula-gallery/ and parses the modulaSettings REST field from the JSON response. The returned object contains the Password Protect credentials in cleartext, which the attacker can then use to bypass gallery access controls on the target site.

See the Wordfence vulnerability report and the upstream fix in changeset 3729079 for the complete code paths.

Detection Methods for CVE-2026-107659

Indicators of Compromise

Unauthenticated GET requests to /wp-json/wp/v2/modula-gallery/ or /wp-json/wp/v2/modula-gallery/{id} from external IP addresses
High-volume enumeration patterns iterating sequential gallery IDs against the core REST endpoint
Access log entries containing modula-gallery in the request URI without an authenticated session cookie
Subsequent unauthorized access to password-protected galleries from the same source IPs

Detection Strategies

Inspect web server access logs for anonymous requests targeting /wp-json/wp/v2/modula-gallery paths
Alert on HTTP 200 responses to the core Modula REST route that contain the modulaSettings key
Correlate gallery REST enumeration with later successful logins to password-protected gallery pages
Review WordPress REST API response bodies at the WAF layer for cleartext password fields

Monitoring Recommendations

Enable REST API request logging in WordPress to capture full request and response metadata
Baseline normal traffic patterns to the /wp-json/wp/v2/ namespace and alert on spikes
Monitor for scanning tools such as wpscan or custom scripts querying Modula CPT endpoints
Audit all REST-exposed custom post types for sensitive data in meta fields

How to Mitigate CVE-2026-107659

Immediate Actions Required

Update the Modula Image Gallery plugin to the patched version released in changeset 3729079
Rotate every Password Protect credential configured in Modula galleries, as prior values must be considered compromised
Audit WordPress access logs for prior unauthenticated requests to /wp-json/wp/v2/modula-gallery/
Treat any gallery previously protected only by the exposed password as having been publicly accessible

Patch Information

The vendor addressed the flaw by modifying the CPT registration logic in includes/admin/cpt/class-modula-cpt.php. The fix is tracked in WordPress plugin changeset 3729079 and applies the same redaction logic used by redact_settings_for_public() to responses served through the core WordPress REST path. Administrators must upgrade past version 3.0.11 to receive the fix.

Workarounds

Disable the Modula plugin until the patched version is deployed if immediate upgrade is not feasible
Block unauthenticated access to /wp-json/wp/v2/modula-gallery/ at the WAF or reverse proxy layer
Restrict the WordPress REST API to authenticated users using an access control plugin or custom rest_authentication_errors filter
Remove sensitive credentials from Modula gallery configurations and rely on WordPress role-based access controls instead

bash

# Example Nginx rule to block unauthenticated access to the vulnerable route
location ~ ^/wp-json/wp/v2/modula-gallery {
    deny all;
    return 403;
}