CVE-2026-39481: WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection vulnerability in the Modula Image Gallery WordPress plugin affects all versions up to and including 2.14.18. The flaw is reachable over the network but requires a high-privilege (administrator-level) account, meaning an attacker must first obtain admin credentials before reaching the vulnerable code path. Successful exploitation allows the attacker to read, modify, or delete data and fully compromise the affected WordPress host. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the WordPress installation via HTTP/HTTPS.

• AuthenticationRequired

  Exploitation requires a high-privilege (admin-level) account; a low-privilege or unauthenticated request is not sufficient to trigger the injection.

• Victim interactionNot required

  The attacker does not need to trick or involve any other user to carry out the attack once admin credentials are available.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• Reads any file accessible to the web server process, including WordPress configuration files containing database credentials.
• Modifies or deletes database rows, post content, user accounts, and plugin configuration stored on the site.
• Executes arbitrary code on the host by deserializing a crafted PHP object that chains to a file-write or system-call gadget in the PHP environment.
• Fully compromises the underlying server, enabling installation of backdoors or use of the host as a pivot point within the same network segment.