CVE-2026-39481

Name of the Vulnerable Software and Affected Versions Modula Image Gallery versions prior to 2.14.19

Description The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress allows authenticated attackers with author-level access and above to perform PHP Object Injection. This occurs through the deserialization of untrusted input, which is the process of converting a stored string back into a PHP object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain in another installed plugin or theme could enable the attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update to a version newer than 2.14.18.