CVE-2026-92713highCWE-862

CVE-2026-92713: high-severity vulnerability in wpchill Modula Image Gallery – Photo Grid &…

Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter

Published

Follow this CVE+ Monitor Modula Image Gallery – Photo Grid & Video Gallery

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.3%
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_image function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and Authors trivially satisfy the edit_post check on their own galleries.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected products
wpchill · Modula Image Gallery – Photo Grid & Video Gallery
Related CVEs — wpchill Modula Image Gallery – Photo Grid &…

In the same product, most dangerous first.

CVE-2024-12853HIGHModula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File UploadEPSS 0.9%CVE-2026-89406HIGHModula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' ParametersEPSS 0.4%CVE-2025-13891MEDIUMImage Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory ListingEPSS 0.4%CVE-2026-121976MEDIUMModula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' ParameterEPSS 0.3%CVE-2026-107659HIGHModula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPTEPSS 0.3%CVE-2025-12494MEDIUMImage Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File MoveEPSS 0.3%