CVE-2026-76010
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
The NextGEN Gallery plugin for WordPress (up to and including 4.4.1) is vulnerable to Remote Code Execution via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model, missing realpath containment in path construction, and a bypassable signature check on the public image delivery route. An authenticated attacker with custom-level access and above can execute code on the server.
Risk Assessment
An attacker with a subscriber account that was ever granted the 'NextGEN Manage gallery' capability can execute arbitrary code on the server, leading to full site compromise. The capability is retained indefinitely even after revocation, increasing the risk.
Recommendation
Update the NextGEN Gallery plugin to a version later than 4.4.1. Additionally, review accounts with gallery management capabilities and restrict them to the minimum necessary.
Other vulnerabilities in NextGEN Gallery
See all- CVE-2026-94123High
The NextGEN Gallery plugin in versions up to and including 4.5.0 contains an Arbitrary File Download vulnerability exploitable by an unauthenticated attacker. This allows downloading arbitrary files from the server.
- CVE-2026-9059Critical
SQL Injection vulnerability in NextGEN Gallery prior to version 4.2.1. An authenticated attacker with 'NextGEN Gallery overview' capability can inject arbitrary SQL into the ORDER BY clause via the 'orderby' parameter in REST API endpoints. Root cause is insufficient sanitization in '_clean_column()' using a blacklist approach.
- CVE-2026-116563Medium
The NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-28141High
Unauthenticated Cross Site Scripting (XSS) vulnerability in NextGEN Gallery versions up to 4.2.3. An attacker can inject malicious script without authentication.
- CVE-2026-6566Medium
The NextGEN Gallery plugin for WordPress up to version 4.2.0 has an Insecure Direct Object Reference vulnerability in the image deletion REST API. Object-level authorization is missing – only 'NextGEN Manage gallery' permissions are checked, without gallery ownership verification. An authenticated attacker with Subscriber privileges and 'NextGEN Manage gallery' capability can delete other users' images and associated files from disk.
Original NVD description (English source)
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS