---
id: "CVE-2026-76010"
kind: "vulnerability"
aliases: ["CVE-2026-76010"]
title: "NextGEN Gallery WordPress plugin: authenticated users can run code on server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "NextGEN Gallery", "fixed": ["4.5.0"], "affected": "<= 4.4.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["nextgen-gallery", "package", "self-hosted", "wordpress"]
not_affected_if: ["auth-required", "managed-hosting", "patched-version", "plugin-not-installed"]
published_at: "2026-10-31T10:16:38+00:00"
first_seen_at: "2026-10-31T10:34:56+00:00"
updated_at: "2026-10-31T10:37:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76010", "first_seen_at": "2026-10-31T10:34:56+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-31T10:37:18+00:00"}]
---

# NextGEN Gallery WordPress plugin: authenticated users can run code on server

The NextGEN Gallery WordPress plugin up to and including 4.4.1 has a flaw in its render_image function that lets an authenticated attacker execute code on the server. The sources say an attacker needs an account with custom-level access or above, and that gallery ownership can be retained after the capability is revoked.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:NextGEN Gallery affected <= 4.4.1 fixed 4.5.0

## How to check

In WordPress admin go to Plugins > Installed Plugins and check the NextGEN Gallery version; 4.4.1 or lower is affected. Also list users who hold or ever held the 'NextGEN Manage gallery' capability and who owns galleries (Subscribers included).

## Fix

Update NextGEN Gallery to 4.5.0 or later (per third-party trackers; not confirmed on the vendor's changelog)

## Timeline

- 2026-10-31T10:34:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76010
- 2026-10-31T10:37:18+00:00 analyst — NVD/Wordfence CNA: <=4.4.1 affected, CVSS 8.8. Fix 4.5.0 comes only from third-party trackers (wordsec, polyarix); vendor changelog/trac pages I could reach were stale or empty, so nothing marked verified. No exploitation or PoC seen. Sibling CVE-2026-76012 (Lightroom LFI) same versions.

## Documents

- [advisory] NVD CVE-2026-76010 (CNA Wordfence) https://nvd.nist.gov/vuln/detail/CVE-2026-76010
- [mentions] WordSec: CVE-2026-76010 patched in 4.5.0 https://wordsec.net/vulnerabilities/plugins/nextgen-gallery/photo-gallery-sliders-proofing-and-themes-nextgen-gallery-441-authenticated-custom-remote-code-execution-via-xml-rpc-meta_data-mass-assignment-and-path-traversal

## From the sources

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_