The vulnerability occurs because the Modula Image Gallery plugin for WordPress exposes sensitive configuration data through a REST API endpoint. An unauthenticated attacker can request the endpoint /wp-json/wp/v2/modula-gallery/{id} or the collection route and receive the plaintext password and username stored in the modulaSettings object. This lack of authorization allows disclosure of credentials used to protect galleries, potentially enabling further attacks on the site. The weakness is a classic example of missing authorization (CWE-862) and directly compromises confidentiality of protected gallery content.

WordPress sites running the wpchill:Modula Image Gallery – Photo Grid & Video Gallery plugin, versions 3.0.11 and earlier. The issue originates from the core /wp-json/wp/v2/modula-gallery REST registration, which is enabled by show_in_rest=true in the plugin’s CPT definition.

With a CVSS base score of 7.5 the vulnerability poses a high risk to affected systems. The exploit path requires only anonymous access to the exposed REST route; no authentication or additional privileges are needed. Because the REST endpoint is publicly reachable on standard WordPress installations, attackers can easily enumerate galleries and harvest the credentials. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog, but the combination of high severity and public exposure still warrants prompt mitigation.