---
id: CVE-2026-76010
title: >-
  Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 -
  Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass
  Assignment and Path Traversal
summary: >-
  The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for
  WordPress is vulnerable to Remote Code Execution in all versions up to, and
  including, 4.4.1 via the render_image function. This is due to unrestricted
  mass ass…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-434
vendor: smub
product: 'Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery'
affected:
  - photo_gallery_sliders_proofing_and_themes_nextgen_gallery <= 4.4.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-02T14:34:08.237352Z'
published: '2026-10-31'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T14:34:16.619Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-76010'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/36dcde20-0af2-4b8b-8637-9a070dffa8a1?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L2373
  - url: >-
      https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/XMLRPC/Controller.php#L289
  - url: >-
      https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L1226
  - url: >-
      https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DynamicThumbnails/Controller.php#L33
  - url: >-
      https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/XMLRPC/Controller.php#L69
  - url: >-
      https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L2951
  - url: >-
      https://plugins.trac.wordpress.org/changeset/3699076/nextgen-gallery/trunk/src/DataStorage/Manager.php
tags:
  - cve.org
epss: 0.00772
epssPercentile: 0.55803
ingestedAt: '2026-11-05T19:30:42.667Z'
---

## Overview

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.

## Affected

- `photo_gallery_sliders_proofing_and_themes_nextgen_gallery <= 4.4.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.