WordPress Plugin Vulnerabilities

Filter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check

Description

The plugin does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the plugin's stored gallery options.

Proof of Concept

Affects Plugins

Plugin icon
filter-gallery
Fixed in 1.1.5

References

CVE
CVE-2026-90978

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Seongwon Lee
Submitter
Seongwon Lee
Verified
Yes
WPVDB ID
39321ecd-98e5-4f4e-9a42-bedf5904c3d1

Timeline

Publicly Published
2026-09-16 (about 2 days ago)
Added
2026-09-16 (about 1 day ago)
Last Updated
2026-09-17 (about 8 hours ago)

Other

Published
Title
Published
2021-02-06
Title
Paid Membership Pro < 2.5.3 - Unauthorised Order Information Disclosure
Published
2024-02-02
Title
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator < 4.4.2 - Missing Authorization
Published
2026-08-03
Title
SEO Redirection Plugin – 301 Redirect Manager < 9.19 - Subscriber+ Redirect Rule Disclosure
Published
2024-05-21
Title
AI ChatBot < 5.3.6 - Missing Authorization via openai_file_upload_callback
Published
2021-05-31
Title
The Plus Addons for Elementor Page Builder < 4.1.11 - Arbitrary Reset Pwd Email Sending