Live › vulnerability › CVE-2026-76010
The NextGEN Gallery WordPress plugin up to and including 4.4.1 has a flaw in its render_image function that lets an authenticated attacker execute code on the server. The sources say an attacker needs an account with custom-level access or above, and that gallery ownership can be retained after the capability is revoked.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 10:34 UTC. All times on this page are UTC.
WordPress sites running the NextGEN Gallery plugin at 4.4.1 or lower where untrusted or low-privilege accounts exist. The attacker needs a login with Custom-level access or above and must own at least one gallery. A Subscriber who was ever granted 'NextGEN Manage gallery' keeps that ownership after the capability is revoked. Sites with no extra user accounts, or without the plugin, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| NextGEN Gallery | wordpress | <= 4.4.1 | 4.5.0 |
4.4.1 or lower is affectedNextGEN Manage gallery capability and who owns galleries (Subscribers included)Update NextGEN Gallery to 4.5.0 or later (per third-party trackers; not confirmed on the vendor's changelog)
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.
This page as .md · .json · in your agent: get_signal("CVE-2026-76010")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.