Modula Image Gallery – Photo Grid & Video Gallery <= 2.14.18 - Authenticated (Author+) PHP Object Injection

This research plan outlines the steps to investigate and exploit a PHP Object Injection vulnerability in the Modula Image Gallery plugin (CVE-2026-39481).

1. Vulnerability Summary

The Modula Image Gallery plugin is vulnerable to PHP Object Injection in versions up to and including 2.14.18. The vulnerability resides in the handling of gallery data (specifically images or settings) during saving or updating operations. The plugin performs unserialize() on user-controlled input without sufficient validation. While no POP (Property Oriented Programming) chain is identified within the plugin itself, an attacker can leverage chains from other installed plugins or WordPress core to achieve Remote Code Execution (RCE).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: modula_save_gallery_images (inferred from plugin architecture for gallery updates) or modula_save_images.
• Vulnerable Parameter: images
• Authentication: Authenticated, Author-level access or higher.
• Preconditions: The attacker must have permissions to create or edit modula-gallery Custom Post Types (CPT).

3. Code Flow

1. The plugin registers an AJAX handler for saving gallery data. In includes/admin/cpt/class-modula-cpt.php, we see registration for actions like modula_remember_tab, but the primary saving logic typically involves a modula_save_gallery_images or similar action registered in the Modula_CPT or Modula_Field_Builder classes.
2. The handler retrieves the images parameter from the $_POST array.
3. The plugin calls unserialize() or maybe_unserialize() on this string (often after stripslashes()).
4. If a malicious PHP serialized object is passed, the object's magic methods (__wakeup, __destruct, etc.) are triggered upon deserialization.

4. Nonce Acquisition Strategy

The AJAX actions in Modula's admin interface are protected by nonces localized in the gallery editor.

1. Identify the Script: Modula localizes settings for its admin editor using a variable often named modula_cpt_vars.
2. Creation: Create a new gallery to access the editor.
   • Command: wp post create --post_type=modula-gallery --post_status=publish --post_title="Exploit Gallery" --post_author=2 (Assuming ID 2 is an Author).
3. Navigation: Use the browser tool to navigate to the edit page for the newly created gallery.
   • URL: /wp-admin/post.php?post=[ID]&action=edit
4. Extraction: Execute JavaScript to retrieve the nonce and the post ID.
   • browser_eval("window.modula_cpt_vars?.nonce")
   • The post ID is typically available in the URL or via browser_eval("document.getElementById('post_ID')?.value").

5. Exploitation Strategy

Step 1: Setup Payload

Prepare a serialized object. Since no chain is present, we will use a "Class Not Found" injection to trigger a detectable PHP error (confirming deserialization).

• Payload: O:20:"Modula_Exploit_Test":0:{}

Step 2: Send Exploitation Request

Use the http_request tool to send the AJAX request.

• Method: POST
• URL: http://[TARGET]/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=modula_save_gallery_images&
  nonce=[NONCE]&
  post_id=[GALLERY_ID]&