CVE-2026-89138

Name of the Vulnerable Software and Affected Versions Filter Gallery versions prior to 1.1.5

Description The plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with subscriber-level access or higher to overwrite the title and content of arbitrary WordPress posts, write the wp attachment image alt meta key on arbitrary posts, and create or overwrite arbitrary ufg gallery * options.

Recommendations Update the plugin to a version newer than 1.1.4.