EUVD-2026-31063
GHSA-4hjj-956w-4cwm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
1DescriptionCVE.org
The Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. This is due to insufficient object-level authorization in the image deletion REST flow where the permission callback for DELETE /imagely/v1/images/{id} only checks 'NextGEN Manage gallery' permissions and does not enforce gallery ownership or 'NextGEN Manage others gallery' permissions. This makes it possible for authenticated attackers, with Subscriber-level privileges and 'NextGEN Manage gallery' capability, to delete gallery images belonging to other users as well as their associated image files from disk when deleteImg is enabled (default).
AnalysisAI
Insecure Direct Object Reference in NextGEN Gallery WordPress plugin through version 4.2.0 allows authenticated attackers with Subscriber-level privileges and the 'NextGEN Manage gallery' capability to delete gallery images belonging to other users, including their physical files from disk. The DELETE /imagely/v1/images/{id} REST endpoint validates only the 'NextGEN Manage gallery' capability, entirely omitting gallery ownership checks and the 'NextGEN Manage others gallery' permission - making cross-user image destruction possible at low privilege. No public exploit code identified at time of analysis and no CISA KEV listing; however, when deleteImg is enabled (default), exploitation results in irreversible file-level data loss beyond what the CVSS 4.3 integrity score alone conveys.
Technical ContextAI
The vulnerability affects the WordPress REST API layer of the NextGEN Gallery plugin (CPE: cpe:2.3:a:smub:photo_gallery,_sliders,_proofing_and_themes_-_nextgen_gallery:*:*:*:*:*:*:*:*), published by SMUB. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the REST permission callback for DELETE /imagely/v1/images/{id} accepts a caller-controlled image ID and checks only whether the requester holds 'NextGEN Manage gallery' capability, never validating that the target image belongs to the requesting user's gallery, nor requiring the elevated 'NextGEN Manage others gallery' capability that should govern cross-gallery operations. Because the image ID is an integer predictable or enumerable from the gallery frontend, an attacker can trivially target records outside their own scope. When the plugin's deleteImg option is active - its default state - the deletion also removes the underlying image file from the server filesystem, escalating the impact from a logical record deletion to permanent file destruction.
RemediationAI
Update the NextGEN Gallery plugin to a version beyond 4.2.0 that incorporates the fix from Trac changeset 3533432 (https://plugins.trac.wordpress.org/changeset/3533432/nextgen-gallery); since the exact patched release version is not independently confirmed from available data, verify the current stable version in the WordPress plugin repository before deploying. As an immediate compensating control prior to patching, administrators should audit all user accounts holding the 'NextGEN Manage gallery' capability via WordPress role management and revoke it from any Subscriber-level accounts that do not require it - this directly eliminates the exploitation path since the capability is not default-assigned. Additionally, disabling the 'deleteImg' option in NextGEN Gallery settings will prevent physical file deletion from disk if exploitation occurs, preserving image files even if logical deletion of database records succeeds; note that this workaround does not block unauthorized record deletion and may affect intended gallery cleanup workflows. No side effects are expected from the capability audit beyond restricting low-privilege gallery management operations.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today