CVE-2026-76010

The record

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.

Affected packages

Related vulnerabilities

• CVE-2026-121733 Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows… CWE-434
• CVE-2026-73328 Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload… CWE-434
• CVE-2026-76124 The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all… CWE-434
• CVE-2026-120534 The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited… CWE-434
• CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom… CWE-434
• CVE-2026-105603 Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in… CWE-434
• CVE-2026-118235 The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications… CWE-434
• CVE-2026-116512 The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time… CWE-434