Filter Gallery (<= 1.1.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/filter-gallery--1.1.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 18 Sep 2026 08:04:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthorization Bypass in WordPress Filter Gallery Pluginhttps://feed.craftedsignal.io/briefs/2026-09-filter-gallery-auth-bypass/Fri, 18 Sep 2026 08:04:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-filter-gallery-auth-bypass/The Filter Gallery WordPress plugin contains an authorization bypass vulnerability (CVE-2026-89413) allowing authenticated users with low-level privileges to delete arbitrary gallery records by omitting mandatory nonce checks.The Filter Gallery plugin for WordPress is affected by an authorization bypass vulnerability, tracked as CVE-2026-89413, impacting all versions up to and including 1.1.4. The flaw originates from the plugin's failure to enforce adequate authorization checks when performing administrative actions. Consequently, any authenticated user with at least subscriber-level permissions can trigger the deletion of arbitrary gallery records, including associated image mappings, configurations, and metadata.

The vulnerability is specifically characterized by an improper nonce validation mechanism. Attackers can bypass this security control by omitting the nonce field entirely in the HTTP POST request; the plugin incorrectly processes the request as valid when the field is absent, whereas it properly rejects requests containing an incorrect or malformed nonce. This vulnerability allows for unauthorized data destruction within the WordPress environment, potentially impacting site functionality and content management workflows.

Attack Chain

  1. Attacker obtains a valid WordPress user account with at least subscriber-level privileges via self-registration or compromised credentials.
  2. Attacker logs into the WordPress administrative interface or interacts directly with the site's REST API/admin-ajax endpoints.
  3. Attacker identifies the specific target gallery IDs by enumerating accessible gallery resources or guessing integer sequences.
  4. Attacker constructs a malicious HTTP POST request targeting the Filter Gallery deletion endpoint.
  5. Attacker explicitly omits the expected 'nonce' parameter from the POST body to bypass the plugin's security verification.
  6. The web server passes the request to the vulnerable plugin, which fails to validate the user's authorization and the presence of the nonce.
  7. The plugin executes the deletion operation for the specified gallery record within the WordPress database.
  8. The targeted gallery, including its associated filters and image mappings, is permanently removed.

Impact

Successful exploitation allows low-privileged attackers to perform unauthorized destructive actions against gallery data. Victims face the loss of all image mappings, custom settings, and filter configurations associated with the targeted galleries, requiring manual restoration from backups. This vulnerability affects any WordPress site running Filter Gallery version 1.1.4 or earlier.

Recommendation

Prioritized actions for security operations and IT teams:

  • Identify and audit all WordPress installations currently utilizing the 'Filter Gallery' plugin.
  • Patch the plugin to the version that remediates CVE-2026-89413 immediately upon availability.
  • Review web server access logs for anomalous POST requests directed at plugin-specific administrative endpoints lacking standard security tokens.
  • Monitor for unauthorized user activity originating from subscriber-level accounts that perform bulk deletion of content or database records.
]]>highadvisory