What is GHSA-hrf4-x4j2-f44x?

GHSA-hrf4-x4j2-f44x is a security advisory published by GitHub Security Advisories with High severity. The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX...

Which CVE IDs does GHSA-hrf4-x4j2-f44x cover?

GHSA-hrf4-x4j2-f44x covers the following CVE IDs: CVE-2026-90978. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hrf4-x4j2-f44x?

GHSA-hrf4-x4j2-f44x has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

GHSA-hrf4-x4j2-f44xHighCVSS 7.1

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX...

Vendor

GitHub Security Advisories

Published

September 18, 2026

Last Modified

September 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-90978 →

📋 Description

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin before 1.1.5's stored gallery options.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-90978
https://wpscan.com/vulnerability/39321ecd-98e5-4f4e-9a42-bedf5904c3d1
https://github.com/advisories/GHSA-hrf4-x4j2-f44x