CVE-2026-89413 in Filter Gallery Plugin
Summary
by MITRE • 09/18/2026
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete any arbitrary Filter Gallery records — including all associated filters, image mappings, settings, and details options — by supplying attacker-controlled gallery IDs. The nonce bypass requires omitting the nonce POST field entirely rather than submitting an invalid value, as a present-but-invalid nonce is correctly rejected.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the Filter Gallery plugin for WordPress represents a critical authorization failure that affects all versions up to and including 1.1.4. This flaw stems from insufficient verification of user permissions when executing administrative actions within the plugin's interface. Specifically, the application logic fails to adequately validate whether the authenticated user possesses the necessary privileges to perform destructive operations on gallery data. In WordPress environments, security relies heavily on role-based access control mechanisms that ensure only users with appropriate capabilities can modify or delete content. The absence of these checks allows attackers who have obtained valid authentication credentials at a subscriber level or higher to bypass intended restrictions and manipulate plugin settings arbitrarily.
From a technical perspective, the core issue lies in how the backend processes requests for deleting Filter Gallery records. When an attacker submits a request containing their own controlled gallery identifiers, the server does not perform a secondary authorization check to confirm that the requesting user is authorized to delete those specific resources or any resource at all within this context. This lack of object-level permission verification means that once basic authentication is established, the application trusts the input without validating the actor's rights relative to the target data. The vulnerability specifically exploits the nonce validation mechanism by demonstrating that omitting the nonces POST field entirely allows the request to proceed, whereas submitting an invalid or missing but present nonce would correctly trigger a rejection. This behavior indicates that the code likely checks for the existence of the nonce rather than its validity and association with the user session, creating a predictable bypass path for malicious actors.
The operational impact of this vulnerability is severe due to the destructive nature of the allowed actions. An authenticated attacker can delete any arbitrary Filter Gallery records, which includes not only the primary gallery entries but also all associated filters, image mappings, settings configurations, and detail options. This results in a complete loss of data integrity for these components, potentially disrupting website functionality that relies on filtered images or specific gallery displays. For site administrators, this means potential downtime, loss of curated content, and increased administrative overhead to restore deleted configurations from backups if available. The ability to target arbitrary records implies that an attacker can selectively remove critical assets or cause widespread disruption by deleting multiple galleries in a single attack sequence.
This vulnerability aligns with CWE-284, which describes Improper Access Control, as the application fails to enforce proper authorization policies for sensitive operations. Furthermore, it relates to CWE-601, URL Redirection to Untrusted Site, if the deletion leads to redirect-based side effects, though primarily it is an access control failure. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to techniques involving unauthorized resource modification and potentially privilege escalation depending on how deeply the attacker can influence site state with low-privileged accounts. The exploitation method highlights a common misconfiguration pattern where developers assume that checking for nonce presence is sufficient without ensuring strict validation against expected values or verifying user roles explicitly before processing destructive commands.
Mitigation strategies must focus on implementing robust authorization checks at both the function and object levels. Developers should ensure that every action requiring state changes verifies not only valid nonces but also explicit role-based permissions using WordPress capability functions such as current_user_can with appropriate caps like edit_others_posts or manage_options, depending on the scope of the plugin's features. It is crucial to validate nonce values strictly rather than merely checking for their presence and to implement object-level security checks that confirm the user owns the resource or has explicit permission to modify it. Upgrading to a patched version where these controls are enforced is the primary remediation step. Additionally, implementing principle of least privilege ensures that even if authentication credentials are compromised at lower levels, the blast radius remains limited by restricting access to administrative functions only for users who genuinely require them. Regular security audits and code reviews focusing on authorization logic can prevent similar flaws in future updates or related plugins within the WordPress ecosystem.