The Modula Image Gallery plugin for WordPress allows an authenticated user with contributor-level permissions to modify arbitrary posts through its REST API. When editing a gallery, the plugin accepts a list of post IDs in the modulaImages field and blindly updates the title, excerpt, and content of those posts without verifying that the user is actually allowed to edit them. This missing authorization check enables content tampering, defacement, or introduction of malicious data on the site. The vulnerability aligns with CWE‑862, Missing Authorization.

The vulnerability affects all installations of the Modula Image Gallery – Photo Grid & Video Gallery plugin up to and including version 2.13.6, supplied by the wpchill vendor. Any WordPress site running a vulnerable version may be impacted, regardless of other plugins or theme configurations.

The CVSS v3 score is 4.3, indicating moderate risk. EPSS is below 1%, meaning that the current likelihood of exploitation is low, and the flaw is not listed in the CISA KEV catalog. Attackers must be authenticated and possess at least contributor access, and the vector requires use of the plugin’s REST API endpoint. While the exploit does not involve remote code execution or privilege escalation, the ability to alter arbitrary content can damage site integrity and trust.