CVE-2026-76010

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.

• CWE-434

• https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L1226
• https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L2373
• https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L2951
• https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DynamicThumbnails/Controller.php#L33
• https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/XMLRPC/Controller.php#L289
• https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/XMLRPC/Controller.php#L69
• https://plugins.trac.wordpress.org/changeset/3699076/nextgen-gallery/trunk/src/DataStorage/Manager.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/36dcde20-0af2-4b8b-8637-9a070dffa8a1?source=cve

Published

Oct 31, 2026

Last Modified

Nov 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76004A security vulnerability has been detected in UTT HiPER 1250…9.9
• CVE-2026-76005The WP Inventory Manager plugin for WordPress is vulnerable …6.5
• CVE-2026-76006The Photo Gallery by Ays – Responsive Image Gallery plugin f…4.9
• CVE-2026-76008A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affec…10
• CVE-2026-76009The Next-Cart Store to WooCommerce Migration plugin for Word…8.1
• CVE-2026-7601A vulnerability has been found in Open5GS up to 2.7.6. Affec…5.3
• CVE-2026-76012The Photo Gallery, Sliders, Proofing and Themes – NextGEN Ga…7.5
• CVE-2026-76014A vulnerability has been found in BusyBox up to 1.30.1. This…3.3
• CVE-2026-76017Use after free in Chromoting in Google Chrome prior to 151.0…8.8
• CVE-2026-76018Privilege elevation in Import in Google Chrome prior to 151.…8.8
• CVE-2026-76019Incorrect authorization in Workers in Google Chrome prior to…8.1
• CVE-2026-7602A vulnerability was found in JeecgBoot up to 3.9.1. Affected…6.3