CVE-2026-89413

Name of the Vulnerable Software and Affected Versions Filter Gallery versions prior to 1.1.5

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can delete arbitrary Filter Gallery records, including associated filters, image mappings, settings, and details options. This is achieved by providing attacker-controlled gallery IDs and omitting the nonce POST field entirely, as the system only rejects the request if a nonce is present but invalid.

Recommendations Update Filter Gallery to version 1.1.5 or later.