How CVE-2026-92713 Works
The flaw lives in includes/admin/helpers/class-modula-gallery-upload.php. The import-file route requires WordPress cookie authentication with a REST nonce, and its capability checks — upload_files, edit_posts, and edit_post on a gallery the user owns — are all satisfied by a default Author, so an ordinary Author account reaches it without admin help. The handler validates the attacker-chosen 'file' path only by location: it must exist, be readable, and sit under the shared uploads basedir. Nothing ties the path to an attachment the user owns. When 'delete_files' is set, upload_image() passes that path straight to media_handle_sideload() as tmp_name, and sideload semantics consume the source. The outcome is deletion of arbitrary non-PHP files under uploads — including other users' attachment originals and generated sizes — scoring integrity and availability loss. Code execution and access outside uploads are not indicated by the code path.
BitFire FREE Bot Protection Stops the Attack at Delivery
BitFire FREE Bot Protection meets this exploit where it must start: a scripted, non-interactive REST call carrying attacker-controlled body parameters to a sensitive plugin route, with no admin UI involved. Bot Protection evaluates who is making the request, classifies restricted automated traffic — REST and AJAX calls, form posts, and logins from unverified clients — and blocks it before WordPress hands the request to Modula's vulnerable handler. Clients presenting as a browser must pass lightweight JavaScript verification, and scripts or fake browsers typically fail, so the chain never reaches rest_import_file() or the destructive sideload. One honest limit: an explicitly allowlisted bot or a successfully verified real-browser session is not categorically stopped, which is why the 3.0.3 patch remains mandatory. For scripted delivery — the form this attack takes — BitFire shuts the door.
Fixed in Modula 3.0.3: Per-File Ownership Authorization
Modula 3.0.3 severs the path-to-delete link. A new Modula_Folder_Import_Path helper replaces the loose strpos prefix test with proper uploads containment, resolves the requested path to the attachment that owns it, and authorize_import() now demands edit_post — and delete_post whenever deletion is requested — on that owner, returning 403 otherwise. upload_image() no longer destroys its input: sideloads copy the file to a temp name first via handle_sideload_without_deleting(), and any deletion happens afterward through maybe_delete_folder_import_source() with a fresh existence check. The folder browser is also narrowed to a dedicated staging directory under uploads. Update immediately; no configuration of 3.0.2 closes this gap.
If Your Site Was Affected, Investigate for Persistence.
Patch to 3.0.3 first — but patching only closes the known path. It does not tell you whether the endpoint was abused while 3.0.2 was installed, and it removes nothing an attacker already put in place. If your site ran an affected version, run BitFire Threat Hunter. Its post-compromise investigation surfaces backdoor WordPress administrator accounts, hidden database triggers, long-running PHP processes, and droppers that can restore malware or reinfect the site. Remove every persistence mechanism it finds, rotate relevant credentials, and do not treat the absence of an obvious malicious file as proof the site is clean. Decisive investigation is the only way to restore confidence after exposure.
Make Scripted Attacks Dead on Arrival
CVE-2026-92713 shows how one missing ownership check turns a media utility into an arbitrary file-deletion weapon for any Author account. BitFire FREE Bot Protection blocks the automated REST delivery this exploit depends on, and BitFire Threat Hunter finds any persistence a successful attacker left behind. Update Modula to 3.0.3 today, put BitFire in front of your site, and investigate anything that ran a vulnerable version. Deploy BitFire FREE now and stop scripted attacks before WordPress runs.
