# CVE-2026-89413: Filter Gallery authorization bypass in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-89413-filter-gallery-authorization-bypass-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89413 · Severity: high · CVSS 8.1 · Published 2026-09-18

The Filter Gallery WordPress plugin fails to properly authorize users before allowing deletion of gallery records. An attacker with a basic subscriber account can delete any gallery and its associated filters, images, and settings by submitting a specially crafted request that bypasses the plugin's nonce verification mechanism, causing permanent data loss.

## Quick answers

**Is CVE-2026-89413 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89413 being exploited in the wild.

**How severe is CVE-2026-89413?** High severity, with a CVSS score of 8.1, published 18 September 2026.

**Which products and versions are affected?** Filter Gallery Filter Gallery up to 1.1.4.

**Is there a fix for CVE-2026-89413?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89413 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-89413?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass flaw in the Filter Gallery WordPress plugin affecting versions up to 1.1.4. The plugin fails to properly validate user authorization and has a nonce bypass vulnerability that can be exploited by omitting the nonce POST field entirely rather than submitting an invalid value. Authenticated attackers with subscriber-level privileges or higher can delete arbitrary gallery records by supplying attacker-controlled gallery IDs. The attack is network-accessible to any authenticated user and requires no additional interaction. An attacker can achieve complete deletion of gallery data, filters, image mappings, and associated settings.

## Affected products

- Filter Gallery Filter Gallery up to 1.1.4

## Timeline

- 2026-09-18: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/filter-gallery/tags/1.1.4/filter-gallery.php](https://plugins.trac.wordpress.org/browser/filter-gallery/tags/1.1.4/filter-gallery.php)
- [https://plugins.trac.wordpress.org/browser/filter-gallery/tags/1.1.4/filter-gallery.php](https://plugins.trac.wordpress.org/browser/filter-gallery/tags/1.1.4/filter-gallery.php)