EUVD-2026-12851Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Author-level user
-
ExploitSubmit gallery shortcode with malicious template parameter
-
ExecutionPlugin includes arbitrary PHP file
-
ImpactExecute arbitrary code on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires NextGEN Gallery plugin for WordPress versions up to 4.0.3. Attacker must be authenticated WordPress user with Author-level access or above. Exploits 'template' parameter in gallery shortcodes to include arbitrary .php files. Most dangerous when .php file uploads are permitted on the server. |
| Impact | The CVSS 3.1 score of 8.8 (High) reflects significant risk with network-based attack vector (AV:N), low complexity (AC:L), and low privileges required (PR:L), meaning any authenticated user with Author role can exploit this. The vulnerability requires authentication, which somewhat limits the attack surface compared to unauthenticated flaws, but Author-level access is commonly granted in WordPress installations with multiple content contributors. The impact ratings are all High (C:H/I:H/A:H), indicating potential for complete system compromise. While no KEV listing or EPSS score is provided in the intelligence data, the availability of source code references showing the exact vulnerable code paths and a published patch significantly increases exploitation risk. The technical tags (PHP, WordPress, RCE, Information Disclosure, LFI) confirm this is exploitable for remote code execution if attackers can upload PHP files or find existing executable files on the server. This represents a genuine priority for WordPress sites using NextGEN Gallery, particularly those with multiple authors or untrusted authenticated users. |
| Exploit ScenarioDerived | An attacker with Author-level WordPress credentials creates or edits a post containing a NextGEN Gallery shortcode with a malicious 'template' parameter pointing to a previously uploaded PHP webshell or existing server configuration file. When the post is viewed or previewed, the vulnerable plugin includes and executes the specified file, granting the attacker arbitrary code execution on the web server. The attacker can then escalate privileges, access database credentials, steal sensitive data, or deploy persistent backdoors. Given the low attack complexity and network-based vector, exploitation requires only standard WordPress access and no user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
The NextGEN Gallery plugin for WordPress contains a Local File Inclusion vulnerability in the 'template' parameter of gallery shortcodes, affecting all versions up to and including 4.0.3. Authenticated attackers with Author-level privileges or higher can include and execute arbitrary PHP files on the server, potentially leading to remote code execution, data theft, or complete site compromise. This is a confirmed vulnerability reported by Wordfence with a high CVSS score of 8.8, though no active exploitation (KEV) status has been reported at this time.
RemediationAI
Update the NextGEN Gallery plugin to version 4.0.4 or later, which includes a patch addressing the Local File Inclusion vulnerability as evidenced by changeset 3460327 in the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset/3460327/nextgen-gallery/trunk/src/DisplayType/LegacyTemplateLocator.php). The patch modifies the LegacyTemplateLocator.php file to properly validate and sanitize the 'template' parameter before file inclusion. As an interim mitigation until patching is possible, restrict Author-level access to only trusted users, implement file upload restrictions to prevent PHP file uploads, and consider using WordPress security plugins with virtual patching capabilities to filter malicious shortcode parameters. Review existing user accounts with Author privileges and audit any gallery shortcodes for suspicious template parameters. Monitor web server logs for unusual file access patterns or inclusion attempts targeting plugin template files.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin (CPE: cpe:2.3:a:smub:photo_gallery,_sliders,_proofing_and_themes_–_nextgen_gallery) for WordPress. The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as Local File Inclusion. The vulnerability exists in the LegacyTemplateLocator.php and Controller.php files, where the 'template' parameter in gallery shortcodes is not properly validated before being passed to PHP include functions. This allows attackers to manipulate file paths and include arbitrary PHP files from the server filesystem, which are then executed in the context of the web application. The flaw is in how the plugin processes template parameters when rendering gallery displays through shortcodes.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.3 via the 'template' parameter in gallery shortcodes. This makes it possible for authenticated attackers, with Author-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Executive ViewAI
A critical vulnerability in the NextGEN Gallery WordPress plugin (versions ≤4.0.3) allows authenticated attackers to execute arbitrary code on affected websites, potentially leading to data theft and complete site compromise. Any organization using this plugin with user accounts at Author level or above faces immediate risk of unauthorized access and malicious activity.
Disable the NextGEN Gallery plugin immediately if not essential to operations; implement WAF rules to block requests containing suspicious characters in gallery shortcode 'template' parameters; restrict Author-level account creation and audit existing accounts; enable WordPress security monitoring and log authentication attempts; consider network segmentation to limit database and file system access from web application layer; enforce strong password policies and multi-factor authentication for all admin accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in WordPress Plugin Local File Inclusion
View all 2In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
GitHub PoC
Exploit-DB