{"id":"CVE-2026-76010","kind":"vulnerability","aliases":["CVE-2026-76010"],"related":[],"title":"NextGEN Gallery WordPress plugin: authenticated users can run code on server","description":"The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.","summary":"The NextGEN Gallery WordPress plugin up to and including 4.4.1 has a flaw in its render_image function that lets an authenticated attacker execute code on the server. The sources say an attacker needs an account with custom-level access or above, and that gallery ownership can be retained after the capability is revoked.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NextGEN Gallery","fixed":["4.5.0"],"affected":"<= 4.4.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["nextgen-gallery","package","self-hosted","wordpress"],"not_affected_if":["auth-required","managed-hosting","patched-version","plugin-not-installed"],"how_to_check":"In WordPress admin go to Plugins > Installed Plugins and check the NextGEN Gallery version; 4.4.1 or lower is affected. Also list users who hold or ever held the 'NextGEN Manage gallery' capability and who owns galleries (Subscribers included).","fix":"Update NextGEN Gallery to 4.5.0 or later (per third-party trackers; not confirmed on the vendor's changelog)","status":"open","published_at":"2026-10-31T10:16:38+00:00","first_seen_at":"2026-10-31T10:34:56+00:00","triaged_at":"2026-10-31T10:35:53+00:00","updated_at":"2026-10-31T10:37:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T10:35:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"NextGEN Gallery WordPress plugin: authenticated users can run code on server","impact":"high","summary":"The NextGEN Gallery WordPress plugin up to and including 4.4.1 has a flaw in its render_image function that lets an authenticated attacker execute code on the server. The sources say an attacker needs an account with custom-level access or above, and that gallery ownership can be retained after the capability is revoked.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","nextgen-gallery","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the WordPress server","analyst_note":"Sources do not state a fixed version; check the NVD entry and the WordPress plugin changelog for a patched release.","how_to_check":"- Check the installed plugin version in the WordPress admin plugins list or the plugin's main file header, looking for version `4.4.1` or lower.\n- Review which users hold the 'NextGEN Manage gallery' capability and who owns galleries.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the NextGEN Gallery plugin at version 4.4.1 or earlier. The sources say exploitation needs an authenticated account that owns at least one gallery, which a Subscriber previously granted the 'NextGEN Manage gallery' capability can hold, and that this access persists after the capability is revoked. Sites without the plugin, or with it at a fixed version, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000734,"input_tokens":4332,"output_tokens":601,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not state a fixed version; check the NVD entry and the WordPress plugin changelog for a patched release.","search":"'-2026':13A,16A '-76010':14A,17A '4.4.1':37B,108C 'access':68B,162C,203C 'account':63B 'assign':120C 'attack':50B,60B,157C,175C 'authent':5A,49B,156C,174C 'author':213C 'bypass':142C 'caller':123C 'caller-suppli':122C 'capabl':80B,200C,223C 'check':144C 'code':9A,52B,99C,167C 'combin':132C 'condit':184C 'construct':139C 'contain':136C 'custom':66B,160C 'custom-level':65B,159C 'cve':12A,15A 'data':126C 'deliveri':149C 'due':116C,207C 'equal':214C 'even':220C 'ever':194C 'execut':51B,100C,166C 'exploit':171C 'fallback':215C 'flaw':40B 'function':45B,113C 'galleri':2A,22B,30B,73B,85C,91C,182C,199C,212C,219C 'gallery':19A 'gallery-author':211C 'grant':195C 'host':26B 'imag':44B,112C,130C,148C 'includ':36B,107C 'indefinit':206C 'key':127C 'least':179C 'let':47B 'level':67B,161C 'make':152C 'manag':198C,218C 'mass':119C 'meta':125C 'miss':134C 'model':131C 'need':61B 'nextgen':1A,18A,21B,29B,90C,181C,197C 'nextgen-galleri':20B 'one':180C 'onto':128C 'ownership':74B 'packag':23B 'path':138C 'photo':84C 'plugin':4A,32B,92C 'possibl':154C 'proof':87C 'public':147C 'realpath':135C 'remot':98C 'render':43B,111C 'requir':172C 'retain':77B,205C 'revok':82B,225C 'rout':150C 'run':8A 'satisfi':188C 'say':58B 'self':25B 'self-host':24B 'server':11A,55B,170C 'signatur':143C 'slider':86C 'sourc':57B 'store':210C 'subscrib':191C 'suppli':124C 'theme':89C 'unrestrict':118C 'user':6A 'version':103C 'via':109C 'vulner':96C 'wordpress':3A,27B,31B,94C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the NextGEN Gallery plugin at 4.4.1 or lower where untrusted or low-privilege accounts exist. The attacker needs a login with Custom-level access or above and must own at least one gallery. A Subscriber who was ever granted 'NextGEN Manage gallery' keeps that ownership after the capability is revoked. Sites with no extra user accounts, or without the plugin, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T10:16:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76010","severity":null,"published_at":"2026-10-31T10:16:38+00:00","modified_at":"2026-10-31T10:16:38+00:00","first_seen_at":"2026-10-31T10:34:56+00:00","fetched_at":"2026-10-31T10:34:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76010:1239","url":null,"severity":null,"published_at":"2026-10-31T10:37:18+00:00","modified_at":"2026-10-31T10:37:18+00:00","first_seen_at":"2026-10-31T10:37:18+00:00","fetched_at":"2026-10-31T10:37:18+00:00","note":"NVD/Wordfence CNA: <=4.4.1 affected, CVSS 8.8. Fix 4.5.0 comes only from third-party trackers (wordsec, polyarix); vendor changelog/trac pages I could reach were stale or empty, so nothing marked verified. No exploitation or PoC seen. Sibling CVE-2026-76012 (Lightroom LFI) same versions."}],"documents":[{"id":31488,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76010","title":"NVD CVE-2026-76010 (CNA Wordfence)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":31489,"url":"https://wordsec.net/vulnerabilities/plugins/nextgen-gallery/photo-gallery-sliders-proofing-and-themes-nextgen-gallery-441-authenticated-custom-remote-code-execution-via-xml-rpc-meta_data-mass-assignment-and-path-traversal","title":"WordSec: CVE-2026-76010 patched in 4.5.0","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}