NextGEN Gallery vulnerabilities

The NextGEN Gallery plugin in versions up to and including 4.5.0 contains an Arbitrary File Download vulnerability exploitable by an unauthenticated attacker. This allows downloading arbitrary files from the server.

SQL Injection vulnerability in NextGEN Gallery prior to version 4.2.1. An authenticated attacker with 'NextGEN Gallery overview' capability can inject arbitrary SQL into the ORDER BY clause via the 'orderby' parameter in REST API endpoints. Root cause is insufficient sanitization in '_clean_column()' using a blacklist approach.

Unauthenticated Cross Site Scripting (XSS) vulnerability in NextGEN Gallery versions up to 4.2.3. An attacker can inject malicious script without authentication.

The NextGEN Gallery plugin for WordPress up to version 4.2.0 has an Insecure Direct Object Reference vulnerability in the image deletion REST API. Object-level authorization is missing – only 'NextGEN Manage gallery' permissions are checked, without gallery ownership verification. An authenticated attacker with Subscriber privileges and 'NextGEN Manage gallery' capability can delete other users' images and associated files from disk.