NextGEN Gallery: Authenticated remote code execution via XML-RPC
Summary
The NextGEN Gallery WordPress plugin (Photo Gallery, Sliders, Proofing and Themes) up to and including version 4.4.1 contains a remote code execution flaw. An authenticated user can mass-assign caller-supplied meta_data keys and abuse missing path containment and a bypassable signature check in the render_image function to run code on the server. Exploitation requires a logged-in account that owns at least one gallery, which any Subscriber who was once granted the 'NextGEN Manage gallery' capability may have, and this ownership is kept even after the capability is revoked.
Affected
- NextGEN Gallery plugin for WordPress (vendor listed as smub), all versions up to and including 4.4.1
Fixed in
Unknown. No fixed version has been confirmed. Check the Wordfence record and the WordPress.org changelog for nextgen-gallery.
Workaround
- No vendor-published workaround is known.
- Remove the NextGEN gallery management capability from all non-essential roles, including custom and Subscriber roles.
- Review gallery ownership and reassign or remove galleries owned by former users.
- Restrict or disable XML-RPC if it is not required. This has not been verified to block this route.
- Check the uploads and NextGEN directories for unexpected PHP files and review web server logs.
Exploitation
- OffSeq: not known to be exploited.
- VulDB: exploit status not defined.
- No public proof of concept, Metasploit module or CISA KEV listing was found in the research. Re-check before the next review.
Our recommendation
- Identify all WordPress sites running NextGEN Gallery and their versions.
- Update to the fixed release as soon as it is confirmed with Wordfence or the WordPress.org changelog.
- Until then, audit user accounts and roles and remove NextGEN management rights from non-essential users.
- Check for unexpected files and review logs for uploads or unusual requests.
- Give higher priority to multi-author sites and sites with former staff or agency accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence vulnerability record www.wordfence.com
- Trac: DataStorage/Manager.php (4.3.0) plugins.trac.wordpress.org
- Trac: XMLRPC/Controller.php (4.3.0) plugins.trac.wordpress.org
- Trac changeset 3699076 (trunk) plugins.trac.wordpress.org
- OffSeq threat radar entry radar.offseq.com
- VulDB entry 429545 vuldb.com
- Threatint CVE mirror cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:20.
Original description (NVD)
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.
NVD references (8)
- https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L1226
- https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L2373
- https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L2951
- https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DynamicThumbnails/Controller.php#L33
- https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/XMLRPC/Controller.php#L289
- https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/XMLRPC/Controller.php#L69
- https://plugins.trac.wordpress.org/changeset/3699076/nextgen-gallery/trunk/src/DataStorage/Manager.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/36dcde20-0af2-4b8b-8637-9a070dffa8a1?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.