{"id":"CVE-2026-76010","published":"2026-10-31T10:16:38.547","lastModified":"2026-10-31T10:16:38.547","description":"The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L1226","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L2373","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L2951","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DynamicThumbnails/Controller.php#L33","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/XMLRPC/Controller.php#L289","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/XMLRPC/Controller.php#L69","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3699076/nextgen-gallery/trunk/src/DataStorage/Manager.php","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36dcde20-0af2-4b8b-8637-9a070dffa8a1?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The NextGEN Gallery plugin for WordPress allows authenticated attackers with custom-level access or higher to execute arbitrary code on the server due to unrestricted mass assignment of meta_data keys onto the image model, missing realpath containment in path construction, and a bypassable signature check on the public image delivery route.","exploitability":"Exploitation requires an authenticated attacker who owns at least one NextGEN gallery, which can be obtained by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability—even after revocation—due to a stored gallery-author equality fallback in _can_manage_gallery().","blast_radius":"Successful exploitation allows full server compromise including data exfiltration, lateral movement, and persistence for authenticated attackers with low privileges.","remediation":"Upgrade to NextGEN Gallery version 4.4.2 or later, which addresses the mass assignment, realpath containment, and signature bypass issues.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","mass-assignment","auth-bypass","web","wordpress","path-traversal"],"model":"garnet-coder","analyzedAt":"2026-11-01T09:57:47.806Z"}}