Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.1 - Authenticated (Author+) Mass Assignment to Arbitrary Post Overwrite/Deletion and Gallery Path Change via REST API
- ID
- WPSEC-2026-0358
- Plugin
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery (nextgen-gallery)
- Affected
- from 4.0.0 before 4.5.2
- Remediation
- Update to 4.5.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-915
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery on WPSec AttackSurface
- Fix released
- Published
Description
The NextGEN Gallery plugin for WordPress is vulnerable to unauthorized modification and deletion of data in versions 4.0.0 up to, and including, 4.5.1 due to the imagely/v1 gallery REST create and update handlers assigning the 'path', 'author', 'slug' and 'extras_post_id' properties directly from the request. This makes it possible for authenticated attackers who hold the plugin's 'NextGEN Manage gallery' capability for a gallery they own (administrators by default; site owners can delegate it to Author-level users through the plugin's Roles settings) to point the gallery's extras_post_id at any post or page, which the next gallery save overwrites (post type, content and all post meta) and deleting the gallery permanently removes, to move the gallery's folder onto another directory inside the gallery root such as another user's gallery, and to reassign gallery ownership.
References
- https://wpsec.com/vuln/WPSEC-2026-0358/
- https://plugins.svn.wordpress.org/nextgen-gallery/tags/4.5.2/
- https://wordpress.org/plugins/nextgen-gallery/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS