CVE-2026-76012 in NextGEN Gallery Plugin
Summary
by MITRE • 10/30/2026
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy_render function. This is due to broken authorization on the Lightroom gallery_edit endpoint combined with mass assignment of gallery path and unrestricted file upload into a registered template directory, whose extension check uses a substring match that accepts sanitized .php_ filenames as valid templates. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to be the stored author of at least one existing NextGEN gallery, as ownership of that gallery is the sole authorization check gating the mass-assignment and upload steps.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in the NextGEN Gallery plugin for WordPress represents a critical Remote Code Execution flaw affecting all versions up through 4.4.1. This security issue stems from a complex chain of failures involving broken access control, insufficient input validation during mass assignment operations, and flawed file extension checking mechanisms within the legacy_render function. The core technical deficiency lies in how the plugin handles gallery editing requests via the Lightroom gallery_edit endpoint. Specifically, the authorization logic relies solely on verifying whether the authenticated user is the stored author of at least one existing NextGEN gallery. This ownership check serves as the sole gatekeeper for both mass-assignment operations and file uploads into registered template directories. Consequently, any attacker possessing custom-level access or higher privileges who can claim ownership of a single gallery gains unrestricted ability to manipulate backend processes without further verification of their intent or scope.
The exploitation path begins with an authenticated user leveraging this weak authorization model to trigger the legacy_render function. During this process, the application performs mass assignment on critical parameters such as the gallery path and file upload destinations. The system fails to properly restrict which fields can be modified by the end-user, allowing attackers to overwrite internal variables that dictate where uploaded files are stored. Furthermore, the validation logic for accepted template extensions is critically flawed because it employs a simple substring match rather than strict extension verification. This implementation error permits filenames ending in .php_ to pass as valid templates. Since many web server configurations treat files with such variations or allow them to be interpreted as PHP scripts under certain conditions, this loophole enables the execution of arbitrary code embedded within these uploaded files.
From an operational impact perspective, successful exploitation allows attackers to achieve full remote code execution on the vulnerable WordPress site. This level of access typically results in complete compromise of the underlying server environment, including potential data exfiltration, installation of web shells for persistent access, and lateral movement across connected systems. The requirement that the attacker must be an authenticated user with custom-level access or above limits the attack surface to insider threats or compromised low-to-medium privilege accounts rather than fully unauthenticated external actors. However, given that many WordPress sites grant author or higher roles to content contributors who may not require deep administrative privileges, this vulnerability remains highly exploitable in typical deployment scenarios where role-based permissions are loosely configured.
This incident aligns with several well-known industry standards and frameworks for categorizing security weaknesses. The broken authorization mechanism corresponds directly to CWE-284 Improper Access Control, as the system fails to enforce proper restrictions on authorized users attempting actions beyond their intended privileges. Additionally, the mass assignment vulnerability falls under CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes, where user input influences object properties without adequate validation or filtering. The unrestricted file upload component is classified under CWE-434 Unrestricted Upload of File with Dangerous Type, highlighting the failure to restrict dangerous file types from being uploaded and executed by the server. In terms of tactical behavior within the MITRE ATT&CK framework, this vulnerability facilitates Initial Access via Valid Accounts (T1078) followed by Execution through Command and Scripting Interpreter on Remote Systems (T1059), specifically leveraging web shells for persistent control over the compromised host.
Mitigation strategies should prioritize immediate upgrading to a patched version of NextGEN Gallery that resolves these authorization and validation flaws if available from the vendor. In cases where patching is not immediately feasible, administrators must enforce strict role-based access controls within WordPress, ensuring that only trusted users with minimal necessary privileges are granted author-level or higher roles. Web Application Firewalls can be configured to detect and block requests targeting the gallery_edit endpoint with suspicious parameters indicative of mass assignment attempts. Furthermore, server-side hardening measures such as disabling PHP execution in upload directories provide a critical layer of defense-in-depth, preventing uploaded files from being executed even if they bypass application-level checks. Regular auditing of user permissions and monitoring for unusual file creation events in template directories can also aid in early detection of exploitation attempts.