CVE-2026-89413: Filter Gallery WordPress Auth Bypass Flaw

CVE-2026-89413 Overview

CVE-2026-89413 is an authorization bypass vulnerability in the Filter Gallery plugin for WordPress affecting all versions up to and including 1.1.4. The plugin fails to verify that a user is authorized to perform destructive gallery operations. Authenticated attackers with subscriber-level access or above can delete arbitrary Filter Gallery records by supplying attacker-controlled gallery IDs. Deleted data includes associated filters, image mappings, settings, and details options. The flaw also contains a nonce bypass: omitting the nonce POST field entirely bypasses the check, while a present-but-invalid nonce is correctly rejected. The vulnerability is categorized under [CWE-862] Missing Authorization.

Critical Impact
Any authenticated WordPress user, including low-privilege subscribers, can permanently destroy Filter Gallery content and configuration across the entire site.

Affected Products

WordPress Filter Gallery plugin versions up to and including 1.1.4
WordPress installations with subscriber-level or higher user registration enabled
Sites relying on Filter Gallery for portfolio, image, or media presentation

Discovery Timeline

2026-09-18 - CVE-2026-89413 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in the NVD database

Technical Details for CVE-2026-89413

Vulnerability Analysis

The Filter Gallery plugin exposes gallery deletion endpoints that operate on gallery IDs supplied via POST parameters. The plugin processes the delete request without confirming that the requesting user holds the capabilities normally required to manage plugin content. As a result, a subscriber account can send crafted requests that destroy gallery records belonging to administrators.

Deletion cascades across related plugin tables. Filters, image-to-gallery mappings, settings blobs, and details options tied to the target gallery ID are removed. The action is destructive and non-recoverable without a backup.

A secondary weakness compounds the impact. The nonce check is only executed when the nonce POST field is present in the request. Omitting the field entirely skips validation, while submitting an invalid nonce is rejected. Attackers therefore avoid the anti-CSRF control by simply not sending the parameter.

Root Cause

The root cause is missing authorization enforcement in the affected handler functions referenced in the plugin source at filter-gallery.php lines 1099, 1112, and 1131. The handlers do not call a capability check such as current_user_can() before executing the deletion logic. The nonce verification path is also conditionally invoked rather than mandatory, producing the omission-based bypass.

Attack Vector

Exploitation requires an authenticated session with at least subscriber-level access. On WordPress sites that allow open registration, this bar is trivially met. The attacker sends a POST request to the vulnerable admin-ajax or admin-post endpoint, includes an attacker-chosen gallery identifier, and omits the nonce field. The plugin executes the deletion without confirming the caller's role or the request's origin.

// No verified proof-of-concept code is published for CVE-2026-89413.
// Refer to the Wordfence advisory and the WordPress plugin source references
// for handler locations and the fix diff.

Detection Methods for CVE-2026-89413

Indicators of Compromise

Unexpected disappearance of Filter Gallery records, filters, image mappings, or settings from the WordPress administrative interface
POST requests to Filter Gallery admin-ajax or admin-post endpoints originating from subscriber-tier accounts
HTTP requests targeting the plugin's delete actions without a _wpnonce or plugin-specific nonce field present
Bulk deletion patterns across multiple gallery IDs within a short time window

Detection Strategies

Enable and review WordPress action logs to capture plugin-level delete operations and the user account that initiated them
Alert on POST requests to Filter Gallery endpoints that lack a nonce parameter yet return a success status
Correlate low-privilege user session activity with administrative content mutations in the database

Monitoring Recommendations

Monitor the WordPress database for row deletions in Filter Gallery tables and options and retain change history
Track newly registered subscriber accounts that immediately interact with plugin admin endpoints
Forward web server access logs to a centralized analytics or SIEM pipeline to identify anomalous POST volume against /wp-admin/admin-ajax.php

How to Mitigate CVE-2026-89413

Immediate Actions Required

Update the Filter Gallery plugin to the patched release published after version 1.1.4 as referenced in the plugin changeset
Audit registered users and remove or downgrade untrusted subscriber accounts
Back up the WordPress database and Filter Gallery tables before applying updates or investigating suspected exploitation
Restore any deleted Filter Gallery records from a known-good backup if signs of exploitation are found

Patch Information

The vendor addressed the vulnerability in the changeset published on the WordPress plugin repository. Review the fix in the WordPress Filter Gallery Changeset and the vulnerable handler locations in the WordPress Filter Gallery Source. Additional advisory context is available in the Wordfence Vulnerability Report.

Workarounds

Disable the Filter Gallery plugin until the patched version is deployed
Disable open user registration by unchecking Anyone can register under WordPress General Settings
Restrict access to /wp-admin/admin-ajax.php for unauthenticated and low-privilege sessions using a Web Application Firewall (WAF) rule that requires a valid plugin nonce

bash

# Disable the plugin from the command line using WP-CLI
wp plugin deactivate filter-gallery

# Optional: remove the plugin files entirely until a patch is available
wp plugin delete filter-gallery