NextGEN Gallery CVE-2026-6566

Exploitation requires two concurrent conditions: (1) a valid WordPress authenticated session at Subscriber level or higher, and (2) the 'NextGEN Manage gallery' capability explicitly assigned to that account by an administrator - this capability is not part of any default WordPress role and must be deliberately granted, which is the primary limiting factor. Physical file deletion from disk further requires the 'deleteImg' setting to be enabled, which is the default configuration but can be disabled by administrators. Unauthenticated exploitation is not possible (CVSS PR:L confirms authentication is required). The attacker must also be able to identify or enumerate valid image IDs belonging to other users' galleries, which is feasible via gallery embeds or API responses. Exploitation is NOT limited to any specific platform or hosting configuration beyond a WordPress installation running NextGEN Gallery ≤4.2.0 with at least one user holding the 'NextGEN Manage gallery' capability.

CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately reflects the low-privilege network-exploitable nature and limited integrity scope, but may understate real-world business impact: permanent deletion of irreplaceable gallery images from disk is a materially worse outcome than the score suggests for photography or media-dependent sites. Attack complexity is genuinely low once the 'NextGEN Manage gallery' capability is held - no race condition, no chained vulnerability, no user interaction required. The critical limiting factor is the prerequisite of both a valid authenticated session and the 'NextGEN Manage gallery' capability, which is not a default WordPress role assignment and must be deliberately granted by an administrator; this meaningfully narrows the attacker pool compared to a pure Subscriber-level flaw. No EPSS data was provided. No KEV listing and no public exploit code identified, consistent with the moderate priority signal. The unchanged scope (S:U) confirms exploitation is bounded within the application. Sites that have granted gallery management capabilities broadly to contributor-class users, or those running multi-tenant gallery setups, face the highest realistic risk.

A WordPress contributor account that has been granted the 'NextGEN Manage gallery' capability - for example, a guest photographer on a shared platform - authenticates to the site and sends a series of DELETE requests to /wp-json/imagely/v1/images/{id}, iterating over integer image IDs observed in gallery embeds or enumerated via the gallery API. The permission callback confirms the capability is held and processes each deletion without checking ownership, permanently removing both the database records and the physical image files from the server for galleries belonging to other users. No public exploit code has been identified at time of analysis, but the attack requires only standard authenticated HTTP requests with no specialized tooling.