Sensitive Information Exposure in Modula Image Gallery Plugin

The Modula Image Gallery - Photo Grid & Video Gallery plugin for WordPress (versions up to and including 3.0.11) contains a sensitive information exposure vulnerability identified as CVE-2026-107659. The issue exists due to inconsistent REST API security controls. While the plugin correctly redacts sensitive data in its own custom API endpoint (/wp-json/modula/v2/gallery/{id}/settings) via the redact_settings_for_public() function, it fails to implement the same protection for the core WordPress REST API endpoint (/wp-json/wp/v2/modula-gallery/{id}).

Because the plugin registers its custom post type with 'show_in_rest' set to true, the core WordPress API exposes the plugin's metadata. Unauthenticated attackers can query this endpoint to retrieve the 'modulaSettings' field, which contains plaintext usernames and passwords used for password-protecting galleries. This exposure allows unauthorized access to private gallery content if those credentials are reused elsewhere. Defenders should monitor for unauthenticated requests targeting the vulnerable REST API endpoints.

Impact

The vulnerability allows unauthenticated attackers to exfiltrate plaintext credentials (usernames and passwords) associated with password-protected galleries. This can lead to unauthorized access to gallery contents and potential credential stuffing attacks if users reuse these passwords on other systems. Given the prevalence of WordPress plugins in enterprise environments, the exposure of these credentials creates a significant risk of data breach and lateral movement.

Recommendation

• Update the Modula Image Gallery - Photo Grid & Video Gallery plugin to the latest version immediately once a patch is released (version > 3.0.11).
• Monitor web server logs for unauthenticated GET requests targeting /wp-json/wp/v2/modula-gallery/ that return a 200 OK status.
• Audit existing WordPress installations to identify and remove stored credentials in gallery settings if they have been exposed.
• Block or restrict access to the WordPress REST API for untrusted IP ranges if the functionality is not required globally.