CVE-2026-90978CWE-284broken-access-control

CVE-2026-90978

High · published September 18, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
26.0
In the wild
Unconfirmed
What it is

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin before 1.1.5's stored gallery options.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00338 · 26.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-09-18T10:16Z
References (1)
https://wpscan.com/vulnerability/39321ecd-98e5-4f4e-9a42-bedf5904c3d1/ · [email protected]
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 18 SEP 06:00Z
    Filter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check
    cvelistv5