CVE-2026-90978 Overview
CVE-2026-90978 is a broken access control vulnerability in the Filter Gallery WordPress plugin before version 1.1.5. The plugin fails to verify nonces on several AJAX handlers when the nonce field is omitted and applies no capability checks. Authenticated users with low privileges can overwrite the content of arbitrary posts and delete the plugin's stored gallery options. The flaw is classified under [CWE-284] Improper Access Control. Attackers exploit the vulnerability over the network with low complexity.
Critical Impact
Any authenticated WordPress user, including subscribers, can overwrite arbitrary post content and destroy Filter Gallery configuration data, enabling site defacement and denial of service.
Affected Products
- Filter Gallery WordPress plugin versions before 1.1.5
Discovery Timeline
- 2026-09-18 - CVE-2026-90978 published to the National Vulnerability Database
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-90978
Vulnerability Analysis
The Filter Gallery plugin exposes several AJAX endpoints intended for administrative gallery management. These handlers rely on a nonce check to validate the origin of requests. However, the code only invokes the nonce verification when the nonce parameter is present in the request. Attackers submitting AJAX requests without the nonce field bypass the check entirely.
The handlers additionally lack any current_user_can() capability enforcement. Any authenticated user, including a subscriber-level account, can therefore reach privileged functionality. The impacted actions permit overwriting the post_content of arbitrary WordPress posts and pages and deleting the plugin's stored gallery option records.
Exploitation destroys plugin configuration state and enables content tampering across the entire site. WordPress installations that allow open user registration face the highest exposure because attackers can self-provision the low-privileged account required for exploitation.
Root Cause
The root cause is a conditional nonce validation pattern combined with a missing authorization check. The affected AJAX callbacks execute the sensitive operation whenever the nonce parameter is absent from the POST body rather than rejecting the request outright. This inverted control flow, paired with the absence of capability verification, produces the broken access control condition tracked as [CWE-284].
Attack Vector
An attacker authenticates to the target WordPress site using any account, then issues crafted admin-ajax.php POST requests to the vulnerable Filter Gallery actions. Omitting the nonce field skips validation, and the handler executes with the caller's session. The attacker supplies a target post ID and replacement content to overwrite posts, or invokes the delete handler to purge stored gallery options. See the WPScan Vulnerability Report for handler-level details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-90978
Indicators of Compromise
- Unexpected modifications to post_content for pages or posts that low-privileged accounts should not touch.
- Missing or reset Filter Gallery option rows in the wp_options table.
- POST requests to /wp-admin/admin-ajax.php referencing Filter Gallery actions from non-administrator sessions.
Detection Strategies
- Alert on admin-ajax.php requests targeting Filter Gallery action names when the request body lacks a nonce parameter.
- Correlate WordPress user roles against AJAX actions to flag subscriber-level accounts invoking gallery management handlers.
- Review WordPress post revision history for bulk post_content overwrites originating from a single non-admin user ID.
Monitoring Recommendations
- Enable WordPress audit logging to capture post updates, option deletions, and the acting user for each change.
- Forward web server access logs and WordPress audit events to a centralized log platform for retention and correlation.
- Monitor new user registrations followed within a short window by AJAX activity against plugin endpoints.
How to Mitigate CVE-2026-90978
Immediate Actions Required
- Update the Filter Gallery WordPress plugin to version 1.1.5 or later on all affected sites.
- Disable open user registration or restrict the default role until the patch is applied.
- Audit recent post revisions and restore any content overwritten by unauthorized users.
- Back up the WordPress database, including the wp_options table, before remediation.
Patch Information
The vendor addressed the vulnerability in Filter Gallery version 1.1.5. The fix enforces nonce verification unconditionally and adds capability checks to the affected AJAX handlers. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the Filter Gallery plugin until the site can be updated to version 1.1.5.
- Block unauthenticated and low-privileged access to Filter Gallery AJAX actions using a web application firewall rule.
- Temporarily set the default new-user role to a value that cannot authenticate to admin-ajax.php handlers where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
