CVE-2026-76010
Received Received - Intake

Remote Code Execution in NextGEN Gallery WordPress Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-76010
EUVD
EUVD-2026-114701

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Remote Code Execution flaw in the NextGEN Gallery WordPress plugin up to version 4.4.1. It exists in the render_image function due to three issues: unrestricted assignment of user-supplied metadata keys to the image model, missing realpath containment in path construction, and a bypassable signature check on the public image delivery route. Exploitation allows authenticated attackers with custom-level access or above to execute arbitrary code on the server.

Impact Analysis

If you use the NextGEN Gallery plugin on your WordPress site, an attacker could gain control of your server by exploiting this flaw. They need at least Subscriber-level access and ownership of one gallery. Even if gallery management permissions are revoked later, the attacker retains access due to a stored fallback mechanism.

Mitigation Strategies

Immediately update the NextGEN Gallery plugin to the latest version beyond 4.4.1. If updating is not possible, consider disabling the plugin temporarily until a patch is applied. Review user roles with custom-level access and above to ensure only trusted users have gallery management capabilities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76010. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart