CVE-2026-90978 in Filter Gallery Plugin
Summary
by MITRE • 09/18/2026
The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin before 1.1.5's stored gallery options.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in versions of the Filter Gallery WordPress plugin prior to release 1.1.5 represents a critical failure in access control mechanisms, specifically manifesting as both Broken Access Control and Missing Function Level Access Control. This flaw allows attackers with low-privileged user accounts, such as subscribers or contributors who typically have limited permissions within the WordPress ecosystem, to perform administrative actions that should be restricted to higher-level roles like administrators. The core of the issue lies in how the plugin handles AJAX requests intended for managing gallery configurations and post content modifications. By failing to enforce proper authentication checks on these endpoints, the application exposes sensitive functionality to unauthorized manipulation.
From a technical perspective, the vulnerability stems from two distinct but related oversights in the codebase handling AJAX operations. First, several AJAX handlers fail to verify the WordPress nonce when it is omitted or not provided by the client request. Nonces are designed to prevent Cross-Site Request Forgery attacks by ensuring that requests originate from legitimate sources within the application context. Second, and more critically, there is a complete absence of capability checks on these endpoints. In standard WordPress development practices, every administrative action must be preceded by a verification using functions such as current_user_can() to ensure the requesting user possesses the necessary permissions for that specific task. The lack of this check means that any authenticated user can invoke these handlers regardless of their assigned role or capabilities within the system.
The operational impact of this vulnerability is severe, allowing an attacker to achieve two primary malicious outcomes: arbitrary post content overwriting and the deletion of stored plugin options. By exploiting the missing capability checks, a low-privileged user can send crafted AJAX requests that modify the database records associated with posts owned by other users or system-wide settings. This effectively allows for defacement, data corruption, or the insertion of malicious code into published content if the post type permits HTML execution. Furthermore, the ability to delete stored gallery options disrupts the functionality of the website's media management features and can lead to a denial of service condition where legitimate galleries fail to render correctly until an administrator manually reconfigures them.
This vulnerability aligns with CWE-269 Improper Privilege Management and CWE-352 Cross-Site Request Forgery, as it involves both unauthorized elevation of privileges and the exploitation of state-changing requests without proper anti-CSRF protections. In terms of the MITRE ATT&CK framework for enterprise security, this behavior maps to T1078 Valid Accounts, where an attacker leverages existing low-privileged credentials to perform actions outside their intended scope, and potentially T1496 Endpoint Denial of Service if the deletion of options causes significant operational disruption. The exploitation requires only authenticated access, making it particularly dangerous in environments with many user accounts or shared hosting scenarios where trust boundaries are often lax.
Mitigation strategies must prioritize immediate patching to version 1.1.5 or later, which addresses these specific code deficiencies by implementing robust nonce verification and enforcing strict capability checks on all AJAX handlers. For organizations unable to update immediately due to compatibility constraints with other plugins or custom themes, temporary mitigations include restricting access to the wp-admin directory via IP whitelisting if feasible, disabling user registration until the patch is applied, or utilizing a Web Application Firewall configured to block suspicious patterns associated with unauthorized AJAX calls targeting post meta and option tables. Additionally, auditing existing code for similar patterns in other plugins can help prevent analogous vulnerabilities from being exploited elsewhere within the WordPress installation.