CVE-2026-6566

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. This is due to insufficient object-level authorization in the image deletion REST flow where the permission callback for DELETE /imagely/v1/images/{id} only checks 'NextGEN Manage gallery' permissions and does not enforce gallery ownership or 'NextGEN Manage others gallery' permissions. This makes it possible for authenticated attackers, with Subscriber-level privileges and 'NextGEN Manage gallery' capability, to delete gallery images belonging to other users as well as their associated image files from disk when deleteImg is enabled (default).

• CWE-639

• https://plugins.trac.wordpress.org/changeset/3533432/nextgen-gallery
• https://www.wordfence.com/threat-intel/vulnerabilities/id/439809ad-21ea-4a0b-b1fd-5de9f8f5ee7a?source=cve

Published

May 20, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6565The Style Kits – Advanced Theme Styles for Elementor, Elemen…6.4
• CVE-2026-65650Elgg before 7.0.0 does not check image dimensions to prevent…4.3
• CVE-2026-65655When OAuth authentication is enabled and browser-facing TLS …2.3
• CVE-2026-65656Improper neutralization of special elements used in a comman…7.8
• CVE-2026-65657Use after free in Microsoft Office allows an unauthorized at…7.8
• CVE-2026-65658Deserialization of untrusted data in Microsoft Office ShareP…8.8
• CVE-2026-65660Improper control of generation of code ('code injection') in…6.5
• CVE-2026-65661Heap-based buffer overflow in Microsoft Office allows an una…7.8
• CVE-2026-65662Out-of-bounds read in Windows GDI allows an authorized attac…5.5
• CVE-2026-65663Deserialization of untrusted data in Microsoft Office ShareP…8.8
• CVE-2026-65664Heap-based buffer overflow in Microsoft Office allows an una…7.8
• CVE-2026-65665Deserialization of untrusted data in Microsoft Office ShareP…8.8