CVE-2026-89138— Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX Action
Quick assessment
Affected
farazfrank Filter Gallery
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89138
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX Action
Source: CVE Program / CVE List V5
Vulnerability Description
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary WordPress posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| farazfrank | Filter Gallery | 0 ~ 1.1.4 | - |
|
II. Public POCs for CVE-2026-89138
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89138
请登录查看更多情报信息。
Other References for CVE-2026-89138 (1)
IV. Related Vulnerabilities
Same weakness: CWE-862
-
CVE-2026-85410
Master Addons for Elementor <= 3.2.2 - Missing Authorization -
CVE-2026-12739
WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticate -
CVE-2026-75017
Magazine Blocks <= 1.8.6 - Missing Authorization to Authenti -
CVE-2026-91707
Divi <= 5.11.1 - Missing Authorization to Unauthenticated Ar -
CVE-2026-18317
Foxtool All-in-One: Contact chat button, Custom login, Media
V. Comments for CVE-2026-89138
No comments yet