CVE-2026-94123
HighCVSS 7.5Summary
The NextGEN Gallery plugin in versions up to and including 4.5.0 contains an Arbitrary File Download vulnerability exploitable by an unauthenticated attacker. This allows downloading arbitrary files from the server.
Risk Assessment
An unauthenticated attacker can download arbitrary files from the server, potentially leading to disclosure of sensitive information such as configuration files or credentials.
Recommendation
Update the NextGEN Gallery plugin to a version newer than 4.5.0.
Other vulnerabilities in NextGEN Gallery
See all- CVE-2026-9059Critical
SQL Injection vulnerability in NextGEN Gallery prior to version 4.2.1. An authenticated attacker with 'NextGEN Gallery overview' capability can inject arbitrary SQL into the ORDER BY clause via the 'orderby' parameter in REST API endpoints. Root cause is insufficient sanitization in '_clean_column()' using a blacklist approach.
- CVE-2026-28141High
Unauthenticated Cross Site Scripting (XSS) vulnerability in NextGEN Gallery versions up to 4.2.3. An attacker can inject malicious script without authentication.
- CVE-2026-6566Medium
The NextGEN Gallery plugin for WordPress up to version 4.2.0 has an Insecure Direct Object Reference vulnerability in the image deletion REST API. Object-level authorization is missing – only 'NextGEN Manage gallery' permissions are checked, without gallery ownership verification. An authenticated attacker with Subscriber privileges and 'NextGEN Manage gallery' capability can delete other users' images and associated files from disk.
Original NVD description (English source)
Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS