{"id":"CVE-2026-76012","kind":"vulnerability","aliases":["CVE-2026-76012"],"related":[],"title":"NextGEN Gallery WordPress plugin: authenticated users can run code on server","description":"The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy_render function. This is due to broken authorization on the Lightroom gallery_edit endpoint combined with mass assignment of gallery path and unrestricted file upload into a registered template directory, whose extension check uses a substring match that accepts sanitized .php_ filenames as valid templates. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to be the stored author of at least one existing NextGEN gallery, as ownership of that gallery is the sole authorization check gating the mass-assignment and upload steps.","summary":"The NextGEN Gallery WordPress plugin up to and including 4.4.1 has a flaw in its Lightroom gallery endpoint that lets a logged-in user upload a file into a template directory and have it executed. An attacker with custom-level access or higher who is the author of an existing gallery can run code on the server.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nextgen-gallery","package","self-hosted","wordpress"],"not_affected_if":["plugin-above-4.4.1","plugin-not-installed"],"how_to_check":"- Check the installed NextGEN Gallery plugin version in the WordPress admin Plugins screen or `wp plugin get nextgen-gallery --field=version` against versions up to `4.4.1`\n- Review user accounts with custom-level access or above and confirm who authored existing galleries","fix":"- Move the NextGEN Gallery plugin to a version later than `4.4.1` (the fixed version is not stated in the sources)","status":"open","published_at":"2026-10-30T18:18:12+00:00","first_seen_at":"2026-10-30T18:55:30+00:00","triaged_at":"2026-10-30T18:56:43+00:00","updated_at":"2026-10-30T18:56:43+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T18:56:43Z","model":"claude-haiku-5-5","output":{"fix":"- Move the NextGEN Gallery plugin to a version later than `4.4.1` (the fixed version is not stated in the sources)","reach":"internet","title":"NextGEN Gallery WordPress plugin: authenticated users can run code on server","impact":"high","summary":"The NextGEN Gallery WordPress plugin up to and including 4.4.1 has a flaw in its Lightroom gallery endpoint that lets a logged-in user upload a file into a template directory and have it executed. An attacker with custom-level access or higher who is the author of an existing gallery can run code on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","nextgen-gallery","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user executes code on the WordPress server","analyst_note":"Find the fixed plugin version and the official advisory; the sources give only NVD and no patched release number.","how_to_check":"- Check the installed NextGEN Gallery plugin version in the WordPress admin Plugins screen or `wp plugin get nextgen-gallery --field=version` against versions up to `4.4.1`\n- Review user accounts with custom-level access or above and confirm who authored existing galleries","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-4.4.1"],"who_is_affected":"Sites running the NextGEN Gallery plugin at version 4.4.1 or earlier are exposed. Exploitation needs an account with custom-level access or above that is the stored author of at least one gallery, so sites with no such users are much less exposed. Sites that do not run this plugin can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4309,"output_tokens":631,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-76012':14A,17A '4.4.1':35B,110C 'accept':152C 'access':68B,170C 'assign':131C,210C 'attack':63B,165C,183C 'authent':5A,164C,182C 'author':74B,121C,188C,204C 'broken':120C 'check':146C,205C 'code':9A,81B,101C,175C 'combin':128C 'custom':66B,168C 'custom-level':65B,167C 'cve':12A,15A 'directori':57B,143C 'due':118C 'edit':126C 'endpoint':43B,127C 'execut':61B,102C,174C 'exist':77B,193C 'exploit':179C 'extens':145C 'file':53B,137C 'filenam':155C 'flaw':38B 'function':115C 'galleri':2A,20B,28B,42B,78B,87C,93C,125C,133C,195C,200C 'gate':206C 'higher':70B 'host':24B 'includ':34B,109C 'least':191C 'legaci':113C 'let':45B 'level':67B,169C 'lightroom':41B,124C 'log':48B 'logged-in':47B 'make':160C 'mass':130C,209C 'mass-assign':208C 'match':150C 'nextgen':1A,19B,27B,92C,194C 'nextgen-galleri':18B 'one':192C 'ownership':197C 'packag':21B 'path':134C 'photo':86C 'php':154C 'plugin':4A,30B,94C 'possibl':162C 'proof':89C 'regist':141C 'remot':100C 'render':114C 'requir':180C 'run':8A,80B 'sanit':153C 'self':23B 'self-host':22B 'server':11A,84B,178C 'slider':88C 'sole':203C 'step':213C 'store':187C 'substr':149C 'templat':56B,142C,158C 'theme':91C 'unrestrict':136C 'upload':51B,138C,212C 'use':147C 'user':6A,50B 'valid':157C 'version':105C 'via':111C 'vulner':98C 'whose':144C 'wordpress':3A,25B,29B,96C","nicknames":[],"mitigations":[],"who_affected":"Sites running the NextGEN Gallery plugin at version 4.4.1 or earlier are exposed. Exploitation needs an account with custom-level access or above that is the stored author of at least one gallery, so sites with no such users are much less exposed. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76012","severity":null,"published_at":"2026-10-30T18:18:12+00:00","modified_at":"2026-10-30T18:33:26+00:00","first_seen_at":"2026-10-30T18:55:30+00:00","fetched_at":"2026-10-30T18:55:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}