---
id: "CVE-2026-118191"
page: "https://infrastack.ai/live/CVE-2026-118191"
kind: "vulnerability"
aliases: ["CVE-2026-118191"]
title: "NextGEN Gallery WordPress plugin: authenticated users can delete arbitrary server files"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "nextgen-gallery", "fixed": ["4.5.6"], "affected": "<= 4.5.5", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["nextgen-gallery", "package", "self-hosted", "wordpress"]
not_affected_if: ["capability-restricted-to-admins", "plugin-not-installed"]
published_at: "2026-11-13T10:17:26+00:00"
first_seen_at: "2026-11-13T10:47:10+00:00"
updated_at: "2026-11-13T10:53:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118191", "first_seen_at": "2026-11-13T10:47:10+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/nextgen-gallery/photo-gallery-sliders-proofing-and-themes-455-authenticated-custom-arbitrary-file-deletion-via-task-list-and-app-config-parameters", "first_seen_at": "2026-11-13T10:53:20+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/nextgen-gallery/photo-gallery-sliders-proofing-and-themes-455-authenticated-custom-arbitrary-file-deletion-via-task-list-and-app-config-parameters"]}]
exploit_sources: []
---

# NextGEN Gallery WordPress plugin: authenticated users can delete arbitrary server files

Link for people: https://infrastack.ai/live/CVE-2026-118191 (this .md is for agents)

The NextGEN Gallery WordPress plugin up to and including 4.5.5 fails to validate file paths in its handle_job function. An authenticated user with the NextGEN Manage gallery capability can delete arbitrary files, such as wp-config.php, which can lead to remote code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:nextgen-gallery affected <= 4.5.5 fixed 4.5.6

## How to check

Plugins screen in WP admin, or run: wp plugin get nextgen-gallery --field=version. Versions 4.5.5 and below are affected. Then open the plugin's Roles screen (Gallery > Roles) and check which non-administrator roles hold 'Manage gallery'. Only those accounts can reach the endpoint.

## Fix

Update NextGEN Gallery to 4.5.6 or later (Wordfence lists 4.5.6 as the patched version). Until then, remove the 'NextGEN Manage gallery' capability from every non-administrator role on the plugin's Roles screen.

## Timeline

- 2026-11-13T10:47:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118191
- 2026-11-13T10:53:20+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/nextgen-gallery/photo-gallery-sliders-proofing-and-themes-455-authenticated-custom-arbitrary-file-deletion-via-task-list-and-app-config-parameters — Wordfence advisory (researcher: Wordfence PRISM) gives patched version 4.5.6, affected <= 4.5.5. Not exploited, no PoC found. Fix not verified: the plugin changelog/trac is not read, and Wordfence is not the maintainer's own page.

## Documents

- [advisory] Wordfence: NextGEN Gallery <= 4.5.5 arbitrary file deletion (CVE-2026-118191) https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/nextgen-gallery/photo-gallery-sliders-proofing-and-themes-455-authenticated-custom-arbitrary-file-deletion-via-task-list-and-app-config-parameters

## From the sources

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_job function in all versions up to, and including, 4.5.5 This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The 'NextGEN Manage gallery' capability required to reach the vulnerable endpoint is granted to Administrators by default but can be delegated to lower-privileged roles via the plugin's Roles screen.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_