CVE-2026-76010 in NextGEN Gallery Plugin
Summary
by MITRE • 10/31/2026
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified within NextGEN Gallery for WordPress represents a critical Remote Code Execution flaw affecting all versions up through 4.4.1. This security issue stems from a complex interplay of three distinct technical failures: unrestricted mass assignment, insufficient path validation, and a bypassable integrity check on the public image delivery mechanism. The core of the vulnerability lies in how the plugin handles metadata associated with images during rendering operations. Specifically, the render_image function accepts caller-supplied meta_data keys without sufficient sanitization or filtering, allowing an attacker to inject arbitrary data into the underlying image model objects. This unrestricted mass assignment enables the manipulation of internal object properties that are subsequently used in file system operations and script execution contexts.
The technical flaw is compounded by a lack of proper path containment when constructing file paths based on this manipulated metadata. In standard secure coding practices, any user-supplied input used to construct file paths must be strictly validated against a predefined base directory using functions like realpath or equivalent canonicalization methods to prevent directory traversal attacks. NextGEN Gallery fails to enforce such restrictions effectively in the affected code path. Consequently, an attacker can craft specific meta_data payloads that include relative path sequences, allowing them to reference files outside the intended image storage directories. This lack of containment is a direct violation of secure file handling principles and aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
Furthermore, the vulnerability exploits weaknesses in the authentication and authorization logic governing access to gallery management features. While exploitation requires an authenticated attacker with at least custom-level access, the definition of this privilege is flawed due to how capabilities are managed within WordPress and NextGEN Gallery specifically. The plugin utilizes a stored gallery-author equality fallback mechanism in its _can_manage_gallery function. This means that if a user was once granted the 'NextGEN Manage gallery' capability for a specific gallery, they retain administrative control over that gallery indefinitely, even after their broader permissions have been revoked or downgraded by an administrator. This persistent privilege escalation allows users with minimal initial access levels, such as Subscribers who were briefly assigned management rights, to maintain full control over galleries and exploit the subsequent code execution flaws.
The operational impact of this vulnerability is severe, enabling authenticated attackers to achieve arbitrary Remote Code Execution on the target web server. By leveraging the mass assignment flaw to inject malicious file paths or script references into image metadata, and then triggering their processing through the public image delivery route with a bypassed signature check, an attacker can execute system commands under the context of the web server process. This typically results in full compromise of the underlying WordPress installation, including access to sensitive database contents, user credentials, and potentially lateral movement within the hosting environment if other services are accessible from that network segment. The ability to bypass integrity checks on public routes means this exploitation can often be triggered via standard HTTP requests without requiring complex interaction with administrative interfaces post-exploitation.
From a threat intelligence perspective, this vulnerability maps closely to ATT&CK technique T1059: Command and Scripting Interpreter, as the ultimate goal is to execute arbitrary code. The initial access vector aligns with T1078: Valid Accounts, specifically leveraging legitimate but overly persistent credentials due to poor privilege lifecycle management. The exploitation of file path manipulation corresponds to techniques involving local file inclusion or directory traversal, often categorized under lateral movement or persistence mechanisms depending on the payload delivered.
Mitigation strategies must address both the immediate technical flaws and the underlying architectural weaknesses. For organizations still running affected versions, upgrading NextGEN Gallery to a version newer than 4.4.1 is the primary remediation step, as developers have addressed these specific issues in subsequent releases. Administrators should immediately audit user roles within WordPress, particularly focusing on any users who may have held 'NextGEN Manage gallery' capabilities in the past. It is crucial to explicitly revoke this capability for all users except those who genuinely require ongoing administrative access to NextGEN galleries. Additionally, implementing strict input validation and output encoding practices across custom plugins can prevent similar mass assignment vulnerabilities. Web Application Firewalls should be configured to detect patterns associated with directory traversal and unusual metadata injection attempts in image-related endpoints as a temporary compensating control until patches are applied.