Live › vulnerability › CVE-2026-107659
Go to dashboardModula Image Gallery for WordPress, up to and including 3.0.11, exposes the plaintext Password Protect password and username of every published gallery through the core WordPress REST API. An unauthenticated attacker can read those credentials and open password-protected galleries.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Modula Image Gallery WordPress plugin at version 3.0.11 or earlier that have galleries using Password Protect. Sites without the plugin, or on a fixed version, are not exposed. Whether unprotected galleries are at risk is unknown from the sources.
No product ranges from the sources yet.
3.0.11 and below./wp-json/wp/v2/modula-gallery without logging in and look for a modulaSettings field containing password values.3.0.11, as released by the vendor (the exact fixed version is unknown from the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.
This page as .md · .json · in your agent: get_signal("CVE-2026-107659")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.