{"id":"CVE-2026-118191","kind":"vulnerability","aliases":["CVE-2026-118191"],"related":[],"title":"NextGEN Gallery WordPress plugin: authenticated users can delete arbitrary server files","description":"The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_job function in all versions up to, and including, 4.5.5 This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The 'NextGEN Manage gallery' capability required to reach the vulnerable endpoint is granted to Administrators by default but can be delegated to lower-privileged roles via the plugin's Roles screen.","summary":"The NextGEN Gallery WordPress plugin up to and including 4.5.5 fails to validate file paths in its handle_job function. An authenticated user with the NextGEN Manage gallery capability can delete arbitrary files, such as wp-config.php, which can lead to remote code execution.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nextgen-gallery","fixed":["4.5.6"],"affected":"<= 4.5.5","ecosystem":"wordpress"}],"ecosystems":[],"tags":["nextgen-gallery","package","self-hosted","wordpress"],"not_affected_if":["capability-restricted-to-admins","plugin-not-installed"],"how_to_check":"Plugins screen in WP admin, or run: wp plugin get nextgen-gallery --field=version. Versions 4.5.5 and below are affected. Then open the plugin's Roles screen (Gallery > Roles) and check which non-administrator roles hold 'Manage gallery'. Only those accounts can reach the endpoint.","fix":"Update NextGEN Gallery to 4.5.6 or later (Wordfence lists 4.5.6 as the patched version). Until then, remove the 'NextGEN Manage gallery' capability from every non-administrator role on the plugin's Roles screen.","status":"open","published_at":"2026-11-13T10:17:26+00:00","first_seen_at":"2026-11-13T10:47:10+00:00","triaged_at":"2026-11-13T10:52:24+00:00","updated_at":"2026-11-13T10:53:20+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:52:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"NextGEN Gallery WordPress plugin: authenticated users can delete arbitrary server files","impact":"high","summary":"The NextGEN Gallery WordPress plugin up to and including 4.5.5 fails to validate file paths in its handle_job function. An authenticated user with the NextGEN Manage gallery capability can delete arbitrary files, such as wp-config.php, which can lead to remote code execution.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","nextgen-gallery","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker deletes wp-config.php, enabling remote code execution on the server","analyst_note":"Confirm the fixed version from the plugin's WordPress.org changelog or the Wordfence advisory; the sources state no fix.","how_to_check":"- Check the installed version of the NextGEN Gallery plugin in the WordPress admin Plugins screen; versions up to and including `4.5.5` are affected.\n- Review which roles hold the 'NextGEN Manage gallery' capability on the plugin's Roles screen.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","capability-restricted-to-admins"],"who_is_affected":"Sites running the NextGEN Gallery plugin up to and including 4.5.5 are exposed. Exploitation needs an account with the 'NextGEN Manage gallery' capability, which Administrators have by default and which can be delegated to lower-privileged roles. Sites that do not run the plugin, or that restrict this capability to trusted administrators only, face less risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000785,"input_tokens":4693,"output_tokens":631,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version from the plugin's WordPress.org changelog or the Wordfence advisory; the sources state no fix.","search":"'-118191':14A,17A '-2026':13A,16A '4.5.5':38B,108C 'access':120C 'administr':161C 'arbitrari':9A,60B,87C,125C 'attack':115C 'authent':5A,50B,114C 'capabl':57B,151C 'code':70B,136C 'custom':118C 'custom-level':117C 'cve':12A,15A 'default':163C 'deleg':167C 'delet':8A,59B,89C,124C,143C 'due':90C 'easili':132C 'endpoint':157C 'execut':71B,137C 'fail':39B 'file':11A,42B,61B,88C,93C,126C,141C 'function':48B,100C 'galleri':2A,23B,31B,56B,74C,80C,150C 'gallery':20A 'grant':159C 'handl':46B,98C 'host':27B 'includ':37B,107C 'insuffici':92C 'job':47B,99C 'lead':67B,133C 'level':119C 'lower':170C 'lower-privileg':169C 'make':110C 'manag':55B,149C 'nextgen':1A,19A,22B,30B,54B,79C,148C 'nextgen-galleri':21B 'nextgen-gallery':18A 'packag':24B 'path':43B,94C 'photo':73C 'plugin':4A,33B,81C,175C 'possibl':112C 'privileg':171C 'proof':76C 'reach':154C 'remot':69B,135C 'requir':152C 'right':140C 'role':172C,177C 'screen':178C 'self':26B 'self-host':25B 'server':10A,129C 'slider':75C 'theme':78C 'user':6A,51B 'valid':41B,95C 'version':103C 'via':173C 'vulner':85C,156C 'wordpress':3A,28B,32B,83C 'wp-config.php':64B,146C","nicknames":[],"mitigations":[],"who_affected":"Sites running the NextGEN Gallery plugin up to and including 4.5.5 are exposed. Exploitation needs an account with the 'NextGEN Manage gallery' capability, which Administrators have by default and which can be delegated to lower-privileged roles. Sites that do not run the plugin, or that restrict this capability to trusted administrators only, face less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nextgengallery"],"ptokens":["gallery","nextgen"],"labels":["high","nextgengallery","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-118191':14A,17A '-2026':13A,16A 'arbitrari':9A 'authent':5A 'cve':12A,15A 'delet':8A 'file':11A 'galleri':2A 'gallery':20A 'nextgen':1A,19A 'nextgen-gallery':18A 'plugin':4A 'server':10A 'user':6A 'wordpress':3A","search_b":"'4.5.5':38B 'arbitrari':60B 'authent':50B 'capabl':57B 'code':70B 'delet':59B 'execut':71B 'fail':39B 'file':42B,61B 'function':48B 'galleri':23B,31B,56B 'handl':46B 'host':27B 'includ':37B 'job':47B 'lead':67B 'manag':55B 'nextgen':22B,30B,54B 'nextgen-galleri':21B 'packag':24B 'path':43B 'plugin':33B 'remot':69B 'self':26B 'self-host':25B 'user':51B 'valid':41B 'wordpress':28B,32B 'wp-config.php':64B","search_c":"'4.5.5':108C 'access':120C 'administr':161C 'arbitrari':87C,125C 'attack':115C 'authent':114C 'capabl':151C 'code':136C 'custom':118C 'custom-level':117C 'default':163C 'deleg':167C 'delet':89C,124C,143C 'due':90C 'easili':132C 'endpoint':157C 'execut':137C 'file':88C,93C,126C,141C 'function':100C 'galleri':74C,80C,150C 'grant':159C 'handl':98C 'includ':107C 'insuffici':92C 'job':99C 'lead':133C 'level':119C 'lower':170C 'lower-privileg':169C 'make':110C 'manag':149C 'nextgen':79C,148C 'path':94C 'photo':73C 'plugin':81C,175C 'possibl':112C 'privileg':171C 'proof':76C 'reach':154C 'remot':135C 'requir':152C 'right':140C 'role':172C,177C 'screen':178C 'server':129C 'slider':75C 'theme':78C 'valid':95C 'version':103C 'via':173C 'vulner':85C,156C 'wordpress':83C 'wp-config.php':146C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118191","severity":null,"published_at":"2026-11-13T10:17:26+00:00","modified_at":"2026-11-13T10:17:26+00:00","first_seen_at":"2026-11-13T10:47:10+00:00","fetched_at":"2026-11-13T10:47:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118191:3866","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/nextgen-gallery/photo-gallery-sliders-proofing-and-themes-455-authenticated-custom-arbitrary-file-deletion-via-task-list-and-app-config-parameters","severity":null,"published_at":"2026-11-13T10:53:20+00:00","modified_at":"2026-11-13T10:53:20+00:00","first_seen_at":"2026-11-13T10:53:20+00:00","fetched_at":"2026-11-13T10:53:20+00:00","note":"Wordfence advisory (researcher: Wordfence PRISM) gives patched version 4.5.6, affected <= 4.5.5. Not exploited, no PoC found. Fix not verified: the plugin changelog/trac is not read, and Wordfence is not the maintainer's own page.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/nextgen-gallery/photo-gallery-sliders-proofing-and-themes-455-authenticated-custom-arbitrary-file-deletion-via-task-list-and-app-config-parameters"]}],"documents":[{"id":145530,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/nextgen-gallery/photo-gallery-sliders-proofing-and-themes-455-authenticated-custom-arbitrary-file-deletion-via-task-list-and-app-config-parameters","title":"Wordfence: NextGEN Gallery <= 4.5.5 arbitrary file deletion (CVE-2026-118191)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}