# CVE-2026-107659: Modula Image Gallery password exposure via REST API

Source: https://junglewise.ai/threats/cve-2026-107659-the-modula-image-gallery-photo-grid-video-gallery-plugin-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107659 · Severity: high · CVSS 7.5 · Published 2026-10-16

The Modula Image Gallery plugin for WordPress, which provides photo and video gallery management, exposes plaintext passwords for password-protected galleries to unauthenticated users through its public REST API endpoint. An attacker can retrieve gallery credentials without any authentication, potentially allowing them to access restricted galleries or understand the security posture of deployed galleries.

Technologies: [Modula Image Gallery – Photo Grid & Video Gallery](https://junglewise.ai/threats/technologies/image-gallery-photo-grid-video-gallery). Vendors: [Modula](https://junglewise.ai/threats/vendors/modula).

## Quick answers

**Is CVE-2026-107659 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107659 being exploited in the wild.

**How severe is CVE-2026-107659?** High severity, with a CVSS score of 7.5, published 16 October 2026.

**Which products and versions are affected?** Modula Image Gallery – Photo Grid & Video Gallery up to and including 3.0.11.

**Is there a fix for CVE-2026-107659?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-107659 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-107659?** Check whether you run Modula Image Gallery – Photo Grid & Video Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the REST API registration where show_in_rest=true exposes the modula-gallery custom post type through /wp-json/wp/v2/modula-gallery/{id}, bypassing the redaction logic implemented in the plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint. Unauthenticated attackers can extract plaintext passwords and usernames from the modulaSettings REST field via the post ID parameter. The plugin correctly redacts sensitive data in its proprietary endpoint but fails to apply equivalent protections on the WordPress core REST exposure.

## Affected products

- Modula Modula Image Gallery – Photo Grid & Video Gallery up to and including 3.0.11

## Timeline

- 2026-10-16: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/](https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/)
- [https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php](https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php)