CVE-2026-89138: Filter Gallery WordPress Auth Bypass Flaw

CVE-2026-89138 Overview

CVE-2026-89138 is an authorization bypass vulnerability in the Filter Gallery plugin for WordPress, affecting all versions up to and including 1.1.4. The plugin fails to verify that a user is authorized to perform sensitive actions on posts and options. Authenticated attackers holding subscriber-level access or higher can overwrite the title and content of arbitrary WordPress posts. They can also write the _wp_attachment_image_alt meta key on arbitrary posts and create or overwrite arbitrary ufg_gallery_* options. The flaw maps to [CWE-862] (Missing Authorization).

Critical Impact
Low-privileged users can modify arbitrary post content and plugin options, enabling site defacement and configuration tampering across affected WordPress installations.

Affected Products

WordPress Filter Gallery plugin versions through 1.1.4
WordPress sites permitting subscriber-level or higher registration
Any WordPress deployment with the vulnerable Filter Gallery plugin installed

Discovery Timeline

2026-09-18 - CVE-2026-89138 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-89138

Vulnerability Analysis

The Filter Gallery plugin exposes AJAX handlers that perform write actions without validating the caller's authorization against the target object. Any authenticated user, including subscribers, can invoke these handlers and mutate data they do not own. The affected code paths reside in filter-gallery.php around lines 843, 845, 884, 885, and 902, according to the plugin's source tree. The mutations include overwriting post titles and content, updating the _wp_attachment_image_alt meta key on arbitrary posts, and writing arbitrary ufg_gallery_* options. Because options can influence plugin behavior and rendered output, attackers can leverage the write primitive for defacement or to alter site configuration.

Root Cause

The root cause is missing authorization enforcement inside the plugin's action handlers. The handlers rely on authentication alone and omit capability checks such as current_user_can('edit_post', $post_id) and per-object nonce validation. Without these checks, WordPress treats any logged-in user as authorized to perform the requested write.

Attack Vector

Exploitation requires network access to the WordPress site and a valid subscriber-level account. The attacker submits crafted requests to the vulnerable plugin endpoints, supplying arbitrary post IDs and payload values. The server executes the write operations without verifying ownership or capability. Refer to the Wordfence Vulnerability Intelligence advisory and the Filter Gallery source at line 843 for the technical details of the affected handlers.

// No verified proof-of-concept code is published for this issue.
// See the Wordfence advisory and plugin source references for handler details.

Detection Methods for CVE-2026-89138

Indicators of Compromise

Unexpected modifications to post titles or content authored by subscriber-role accounts.
New or overwritten WordPress options beginning with the ufg_gallery_ prefix in the wp_options table.
Unexplained changes to the _wp_attachment_image_alt post meta on media attachments not owned by the modifying user.
Spikes in AJAX or admin-ajax requests to Filter Gallery endpoints from low-privilege sessions.

Detection Strategies

Audit the WordPress wp_posts table for revisions where the post_author does not match the user who last edited the record.
Query wp_options for rows matching option_name LIKE 'ufg_gallery_%' and compare against a known baseline.
Enable WordPress activity logging to capture all write requests originating from subscriber and contributor roles.

Monitoring Recommendations

Forward web server access logs and WordPress audit events to a central log platform for correlation.
Alert when non-editor accounts trigger post updates or option writes tied to Filter Gallery handlers.
Track plugin file integrity and inventory to identify Filter Gallery installations pinned to 1.1.4 or earlier.

How to Mitigate CVE-2026-89138

Immediate Actions Required

Update the Filter Gallery plugin to a version above 1.1.4 that includes the authorization fix.
If no patched version is available in your environment, deactivate and remove the plugin until it can be updated.
Review WordPress user accounts and remove unused subscriber-level access that could be leveraged for exploitation.

Patch Information

The plugin author committed a fix tracked in the WordPress Filter Gallery changeset 3695415. Administrators should apply the vendor-supplied update through the WordPress plugin manager and confirm that the installed version is greater than 1.1.4.

Workarounds

Restrict new user registration or set the default role below subscriber where feasible.
Deploy a web application firewall rule to block requests to Filter Gallery AJAX handlers from non-privileged sessions.
Restore modified posts and ufg_gallery_* options from a known-good backup after remediation.

bash

# Identify Filter Gallery plugin version via WP-CLI
wp plugin get filter-gallery --field=version

# Update the plugin once a fixed release is available
wp plugin update filter-gallery

# Inspect ufg_gallery_* options for unexpected entries
wp option list --search='ufg_gallery_*'