CVE-2026-107659

Executive Summary

CVE-2026-107659 is a sensitive information exposure vulnerability in the WordPress plugin "Modula Image Gallery – Photo Grid & Video Gallery" affecting all versions up to and including 3.0.11. Because the custom post type is registered with show_in_rest=true, unauthenticated attackers can query the core /wp-json/wp/v2/modula-gallery endpoint and read the modulaSettings REST field, which leaks the plaintext username and Password Protect password for every published gallery. The impact is high confidentiality loss (CVSS 7.5) — offline-protected private galleries can be unlocked directly, and reused credentials may expose unrelated accounts.

Technical Analysis

The root cause is a missing authorization/redaction control (CWE-862, Missing Authorization) on a REST route that is auto-generated by WordPress core rather than custom-written by the plugin.

Two parallel REST surfaces exist:

1. The plugin's own route: /wp-json/modula/v2/gallery/{id}/settings. According to the NVD description, this endpoint "correctly redacts the password for unauthenticated callers via redact_settings_for_public()."
2. The core-generated route: /wp-json/wp/v2/modula-gallery/{id} (or the collection route /wp-json/wp/v2/modula-gallery when no ID is supplied). This route is exposed because the Modula gallery custom post type (CPT) is registered with show_in_rest=true.

When WordPress registers a CPT with show_in_rest=true, core automatically exposes the post object (and any registered meta/settings exposed to REST) under /wp-json/wp/v2/<rest_base>. Fields returned by that route are not passed through the plugin's custom public-redaction logic. As a result, the modulaSettings REST field is serialized and returned to any unauthenticated caller, including the plaintext "Password Protect" password and the associated username stored for the gallery.

Key characteristics:

• Attack vector: Network (AV:N), no privileges (PR:N), no user interaction (UI:N).
• Complexity: Low (AC:L) — a single unauthenticated HTTP GET request to a predictable, discoverable route.
• Scope: Unchanged (S:U) — impact stays within the plugin/WordPress authorization boundary.
• Confidentiality: High (C:H) — plaintext secrets are disclosed.
• Integrity/Availability: None (I:N/A:N) — this is a read-only data exposure; no modification or DoS.

The mechanism is a classic "shadow API" / inconsistent-control-path defect: the developer implemented redaction on one code path but did not replicate it on the core-generated REST path. The id parameter (post ID) on the item route, or omitting it on the collection route, is the sole input required to enumerate galleries.

The exposure is silent — no authentication event, no error, no unusual response code distinguishes an attack from legitimate REST browsing.

Exploitation Scenarios

No public PoC or Nuclei template is available for CVE-2026-107659; the attack chain below is inferred from the vulnerability class and the description as published. No specific function names, endpoints, or parameters beyond those quoted in the NVD description are assumed.

1. Reconnaissance / target identification. An attacker scans for WordPress sites running the Modula plugin — e.g., via http.html:"/wp-json/wp/v2/modula-gallery" or http.html:"modula-gallery" in Shodan, or by probing the REST root for the modula-gallery namespace. No authentication is required to enumerate the route.

2. Triggering the flaw. The attacker issues one or more unauthenticated HTTP GET requests to the core-generated REST path that the plugin's CPT registration exposes: /wp-json/wp/v2/modula-gallery/{id} for a specific gallery, or /wp-json/wp/v2/modula-gallery for the collection. Because the CPT is registered with show_in_rest=true and no equivalent to redact_settings_for_public() is applied on this path, the modulaSettings field is returned with the plaintext Password Protect password and username intact.

3. Payload / execution (class-level). No exploit payload is required — exploitation is a well-formed, unauthenticated REST read. The only "input" is the post ID on the item route or an omitted ID on the collection route. The response body contains the leaked secret material in JSON.

4. Post-exploitation impact. The attacker extracts the plaintext passwords/usernames for every published gallery. These can be used to view galleries the owner intended to keep private (password-protect bypass), and, because users frequently reuse credentials, may enable credential-stuffing against other services or WordPress accounts. Since the read is silent and read-only, no cleanup is required and no integrity/availability impact occurs.

Impact Assessment

This is a high-confidentiality, low-complexity, fully unauthenticated information disclosure. With CVSS 3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), it is straightforward to exploit at scale and can be scripted across large numbers of WordPress installs without any victim interaction.

Business impact:

• Privacy loss: Private/password-protected galleries are exposed to anyone who can reach the REST endpoint.
• Credential exposure: Plaintext usernames and passwords are disclosed for every published gallery, enabling credential reuse attacks.
• Compliance exposure: Secret/key disclosure may trigger GDPR/data-protection and similar notification requirements where gallery access implies personal data.
• Reputational risk: Sites relying on gallery passwords for controlled content (client proofs, membership, paid previews) lose that control entirely.

Affected systems / blast radius: Any WordPress site running the affected Modula Image Gallery plugin up to and including 3.0.11 whose galleries are published. The blast radius scales with the number of galleries and the degree of password reuse across services. Exploitation requires only outbound HTTPS to the target; it is internet-wide and parallelizable.

Severity framing: High. The only mitigating factor is the read-only nature (no I or A impact). The combination of unauthenticated access, deterministic route knowledge, plaintext secret disclosure, and no exploit prerequisites makes mass exploitation practical.

Detection Guidance

Because exploitation is a legitimate-looking, unauthenticated REST read of the core-generated /wp-json/wp/v2/modula-gallery route, network and log detection should focus on who is requesting that path, from where, and how often — rather than on malformed payloads (there are none).

Sigma Rule

title: Modula Gallery Plugin Sensitive Information Exposure via REST API
id: 7c6f0c2a-9f1b-4e2a-8d3c-1a2b3c4d5e6f
status: experimental
description: Detects unauthenticated access to the core WordPress REST route for the Modula gallery CPT, which may leak modulaSettings (password/username) in all versions <= 3.0.11.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107659
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.107659
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/wp-json/wp/v2/modula-gallery'
      - '/wp-json/modula/v2/gallery/'
  selection_method:
    cs-method: 'GET'
  condition: selection_path and selection_method
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate unauthenticated front-end gallery rendering using the REST API
level: medium

YARA Rule

rule CVE_2026_107659_Modula_REST_Exposure
{
    meta:
        description = "Detects references to the vulnerable Modula gallery REST paths and modulaSettings field in web logs, cached responses, or plugin source."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107659"
        date = "2026-01-01"
        severity = "high"

    strings:
        $rest_core = "/wp-json/wp/v2/modula-gallery"
        $rest_plugin = "/wp-json/modula/v2/gallery/"
        $settings = "modulaSettings"
        $redact = "redact_settings_for_public"

    condition:
        any of ($rest_core, $rest_plugin) and $settings
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107659 Modula Gallery REST Sensitive Information Exposure (modula-gallery endpoint access)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/wp-json/wp/v2/modula-gallery"; nocase; http.uri; content:"/wp-json/modula/v2/gallery/"; nocase; sid:2026107659; rev:1; reference:cve,2026-107659; classtype:attempted-recon; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where
      http.request.method == "GET" and
      wildcard(http.request.uri.path, "/wp-json/wp/v2/modula-gallery*") ]

Splunk SPL Query

index=web (cs_uri_stem="*\/wp-json\/wp\/v2\/modula-gallery*" OR cs_uri_stem="*\/wp-json\/modula\/v2\/gallery\/*")
| stats count min(_time) as first_seen max(_time) as last_seen values(cs_uri_stem) as paths by src_ip, cs_host
| where count >= 5
| sort - count
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table first_seen last_seen src_ip cs_host count paths

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-107659,">
  <rule id="100659" level="10">
    <if_sid>31100</if_sid>
    <url>/wp-json/wp/v2/modula-gallery</url>
    <description>CVE-2026-107659: Unauthenticated access to Modula gallery REST endpoint (possible sensitive information exposure via modulaSettings).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_107659,</group>
  </rule>
  <rule id="100660" level="10">
    <if_sid>31100</if_sid>
    <url>/wp-json/modula/v2/gallery/</url>
    <description>CVE-2026-107659: Access to Modula gallery settings REST route; validate redaction of modulaSettings.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_107659,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source claims a patch; not independently confirmed; no fixed plugin version has been identified and the vendor fix field is N/A). Treat the fix as unverified until a vendor advisory or plugin changelog confirms the fixed version.

1. Immediate mitigations (until a confirmed fixed version is available):

   • Disable or remove the plugin if password-protected galleries are not essential.
   • Restrict access to the REST routes at the edge/reverse proxy (deny /wp-json/wp/v2/modula-gallery for unauthenticated callers) — but verify this does not break legitimate front-end gallery rendering.
   • Avoid relying on the plugin's Password Protect feature to protect genuinely sensitive content; treat any password stored by the plugin as already disclosed.
   • Rotate any passwords that have ever been used as gallery-protect passwords, and ensure those credentials are not reused elsewhere.

2. Patch / upgrade:

   • Monitor the plugin's changelog and vendor advisory for a version that applies redact_settings_for_public()-equivalent redaction to the core /wp-json/wp/v2/modula-gallery route (i.e., removes modulaSettings secrets from the REST response for unauthenticated callers).
   • Once a fixed version is published, upgrade Modula to that version and confirm by re-querying the endpoint unauthenticated that no password/username is returned.
   • Because the patch is CLAIMED by only one source, do not assume the current or any specific release is fixed without verification.

3. Long-term hardening:

   • Register custom post types with show_in_rest=false unless REST exposure is required, or explicitly control which meta fields are exposed.
   • Never store secrets in fields serialized by default REST responses; apply redaction at the data-source level rather than per-endpoint.
   • Add CI/unit tests asserting that secret fields are absent from every public REST response for every route that serializes the object.
   • Deploy WAF/IDS rules (see Detection Guidance) to alert on unauthenticated access to gallery REST routes.

References

• NVD — CVE-2026-107659: https://nvd.nist.gov/vuln/detail/CVE-2026-107659
• MITRE CWE-862 (Missing Authorization): https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• WordPress REST API Handbook (registering custom post types and REST exposure): https://developer.wordpress.org/rest-api/
• Modula Image Gallery plugin (vendor product page / WordPress.org plugin repository): https://wordpress.org/plugins/modula-best-grid-gallery/

Known threat actor campaigns or exploit-in-the-wild evidence: none reported. CISA KEV status: NOT listed. No public PoC, exploit code, or Nuclei template is available as of this writing.