NextGEN Gallery CVE-2026-76010

Exploitation requires an authenticated WordPress account with NextGEN 'custom-level' access or above that owns at least one NextGEN gallery (CVSS PR:L). Critically, this prerequisite is far easier to meet than it appears: any Subscriber who was ever granted the 'NextGEN Manage gallery' capability keeps exploitable access permanently because _can_manage_gallery() falls back to gallery-author equality even after the capability is revoked, so capability revocation does not remove the risk. The flaw chains three specific conditions in the render_image path: unrestricted mass assignment of caller-supplied meta_data keys onto the image model, absence of realpath containment during path construction, and a bypassable signature check on the public image delivery route. The main limiting factor is that a fully unprivileged, never-authorized visitor cannot trigger it - the attacker must have (or have previously had) gallery ownership; there is no required victim user interaction.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, resulting in full confidentiality/integrity/availability loss - consistent with server-side remote code execution. The vuln.today decision label is 'this_week', and the finding is attributed to Wordfence, a credible WordPress security research source. Reinforcing the real-world concern, the privilege requirement is unusually weak in practice: although PR:L nominally means authenticated, the description explains that any Subscriber ever granted the 'NextGEN Manage gallery' capability retains exploitable access indefinitely because of the gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked, effectively lowering the real barrier below what PR:L suggests. Signals are largely consistent rather than conflicting. Key limitations to note: no EPSS score, no CISA KEV listing, and no verified public exploit are present in the supplied data, so there is no evidence of active exploitation yet - the urgency here derives from the mechanism, decision label, and privilege-escalation-like persistence, not from observed in-the-wild activity.

An attacker who holds (or once held) a NextGEN gallery authoring role on a target WordPress site uses their authenticated session to submit crafted image meta_data keys that are mass-assigned onto the image model, steering file path construction outside the intended directory due to missing realpath containment, then bypasses the signature check on the public image delivery route to place and retrieve a malicious file as executable code. No special user interaction is required. No verified public exploit is identified in the available data; the referenced sources are a Wordfence advisory and plugin source-code locations rather than working exploit code.