What is the CVSS score of CVE-2026-1463?

CVE-2026-1463 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-1463?

A critical vulnerability in the NextGEN Gallery WordPress plugin (versions ≤4.0.3) allows authenticated attackers to execute arbitrary code on affected websites, potentially leading to data theft and…

How to fix or mitigate CVE-2026-1463?

Within 24 hours: Audit all user accounts with Author privileges or higher and consider temporary role restrictions; document current plugin version across all WordPress instances. Within 7 days: Evaluate alternatives to NextGEN Gallery or disable the plugin entirely if not business-critical; implement Web Application Firewall rules to block suspicious template parameter requests. Within 30 days: Migrate to a patched version or alternative gallery solution once vendor releases a security update; establish a formal plugin inventory and patch management process.

PHP CVE-2026-1463

EUVD-2026-12851 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-18 Wordfence

WordPress PHP LFI RCE Information Disclosure

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 18, 2026 - 17:00 euvd

EUVD-2026-12851

Analysis Generated

Mar 18, 2026 - 17:00 vuln.today

CVE Published

Mar 18, 2026 - 16:26 nvd

HIGH 8.8

DescriptionCVE.org

The Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.3 via the 'template' parameter in gallery shortcodes. This makes it possible for authenticated attackers, with Author-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

AnalysisAI

The NextGEN Gallery plugin for WordPress contains a Local File Inclusion vulnerability in the 'template' parameter of gallery shortcodes, affecting all versions up to and including 4.0.3. Authenticated attackers with Author-level privileges or higher can include and execute arbitrary PHP files on the server, potentially leading to remote code execution, data theft, or complete site compromise. This is a confirmed vulnerability reported by Wordfence with a high CVSS score of 8.8, though no active exploitation (KEV) status has been reported at this time.

Technical ContextAI

This vulnerability affects the Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin (CPE: cpe:2.3:a:smub:photo_gallery,_sliders,_proofing_and_themes_–_nextgen_gallery) for WordPress. The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as Local File Inclusion. The vulnerability exists in the LegacyTemplateLocator.php and Controller.php files, where the 'template' parameter in gallery shortcodes is not properly validated before being passed to PHP include functions. This allows attackers to manipulate file paths and include arbitrary PHP files from the server filesystem, which are then executed in the context of the web application. The flaw is in how the plugin processes template parameters when rendering gallery displays through shortcodes.

RemediationAI

Update the NextGEN Gallery plugin to version 4.0.4 or later, which includes a patch addressing the Local File Inclusion vulnerability as evidenced by changeset 3460327 in the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset/3460327/nextgen-gallery/trunk/src/DisplayType/LegacyTemplateLocator.php). The patch modifies the LegacyTemplateLocator.php file to properly validate and sanitize the 'template' parameter before file inclusion. As an interim mitigation until patching is possible, restrict Author-level access to only trusted users, implement file upload restrictions to prevent PHP file uploads, and consider using WordPress security plugins with virtual patching capabilities to filter malicious shortcode parameters. Review existing user accounts with Author privileges and audit any gallery shortcodes for suspicious template parameters. Monitor web server logs for unusual file access patterns or inclusion attempts targeting plugin template files.