CVE-2026-89138 in Filter Gallery Plugin
Summary
by MITRE • 09/18/2026
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary WordPress posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The Filter Gallery plugin for WordPress contains a critical authorization bypass vulnerability affecting all versions up through 1.1.4. This security flaw stems from insufficient verification of user privileges when processing administrative actions within the plugin's interface. Specifically, the code fails to enforce proper capability checks before allowing modifications to post data and plugin-specific configuration options. As a result, any authenticated user with subscriber-level access or higher can exploit this weakness to perform operations that should be restricted to administrators or users with elevated permissions. This represents a significant deviation from standard WordPress security practices, where role-based access control is strictly enforced for sensitive actions such as content modification and system configuration changes.
The technical nature of the vulnerability allows attackers to manipulate arbitrary posts on the target site. By exploiting the lack of authorization checks, an attacker can overwrite the title and content fields of any post or page hosted on the WordPress installation. This capability enables malicious actors to deface website content, inject phishing links, or spread malware through compromised pages. Additionally, the vulnerability permits the writing of arbitrary metadata, specifically the wp_attachment_image_alt meta key, which may be leveraged for search engine optimization attacks or further exploitation depending on how the theme processes this data. Beyond post manipulation, attackers can create or overwrite options prefixed with ufg_gallery*, effectively altering the plugin's configuration settings without authorization. This could lead to persistent backdoors, disabled security features, or other unintended behaviors that compromise the integrity of the application environment.
From an operational perspective, this vulnerability poses a severe risk to website owners and their audiences. The ability for low-privileged users to modify content means that even non-administrative accounts can be used as vectors for site defacement or malicious redirection. In multi-author environments where contributors are granted subscriber-level access by default, the blast radius of exploitation is significantly widened. Attackers who compromise a single user account with minimal privileges can escalate their impact to affect the entire website's content and configuration. This undermines trust in the platform and may lead to data integrity issues, SEO penalties due to injected spammy content or links, and potential compliance violations if sensitive information is exposed through manipulated posts.
This vulnerability aligns closely with CWE-269, which describes Improper Privilege Control, as it involves a failure to enforce required permissions for specific actions. It also maps to the MITRE ATT&CK framework under techniques related to privilege escalation and persistence, such as T1078 Valid Accounts if an attacker gains initial access through compromised credentials, followed by lateral movement or impact via content modification. The exploitation path typically requires only authenticated access, making it particularly dangerous in scenarios where user accounts are easily obtainable through credential stuffing or phishing attacks.
Mitigation strategies should prioritize immediate remediation of the affected software version. Website administrators must update the Filter Gallery plugin to a patched version released after 1.1.4 that includes proper capability verification for all administrative endpoints and functions exposed by the plugin. Until an official patch is available, it is advisable to disable or deactivate the plugin entirely if its functionality is not strictly required. Additionally, implementing strict role-based access controls can help limit the potential impact; ensuring that only trusted administrators have subscriber-level or higher privileges reduces the pool of potential attackers who could exploit this flaw. Regular security audits and monitoring for unusual content modifications by low-privileged users are also recommended to detect any attempted exploitation activities early.