NextGEN Gallery CVE-2026-76012

Exploitation requires an authenticated WordPress account with custom-level access or above, AND that account must be the stored author of at least one existing NextGEN gallery - gallery ownership is the only authorization check gating the vulnerable mass-assignment and upload steps. The concrete trigger is the Lightroom gallery_edit endpoint, where broken authorization allows mass assignment of the gallery path, combined with unrestricted upload into a registered template directory whose extension check uses a substring match that treats a sanitized '.php_' filename as a valid template; the legacy_render function then executes it. Limiting factors: it is not unauthenticated (PR:L) and not default-config exploitable - installs that do not grant untrusted users custom+ roles or do not let them author galleries are not reachable, which is why CVSS rates attack complexity high. Applies to all versions up to and including 4.4.1.

This is a genuine remote code execution flaw (CWE-434, unrestricted file upload) in NextGEN Gallery, but the supplied signals point to a serious-yet-gated issue rather than a drop-everything emergency. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N (base 7.5) encodes the key tension: the vector is network-reachable (AV:N) and needs no user interaction (UI:N), yet it requires privileges (PR:L) and carries high attack complexity (AC:H). The AC:H and PR:L are explained by the description's stated precondition - the attacker must hold custom-level access or above AND already be the stored author of at least one existing NextGEN gallery, which is the sole authorization check gating the mass-assignment and upload. That is a concrete, attacker-uncontrolled precondition, so this is not a default-configuration unauthenticated RCE. No EPSS probability was provided, the CVE is not listed in CISA KEV, and no confirmed public exploit code is present - the references are the Wordfence advisory and WordPress trac source-line links, not a working exploit. The vuln.today decision label is this_week, consistent with a high-impact but privilege-gated bug that should be patched promptly rather than treated as emergency. Overall: real priority for any site that grants untrusted users custom+ roles and gallery authorship, lower practical risk for locked-down single-author installs.

An attacker who already holds a custom-level-or-above WordPress account and is the stored author of at least one NextGEN gallery abuses the broken authorization on the Lightroom gallery_edit endpoint to mass-assign the gallery path, then uploads a file into a registered template directory whose extension check uses a substring match that accepts a sanitized .php_ filename as a valid template. The legacy_render function then executes that template as PHP code on the server. No public, verified exploit code is identified at time of analysis, so this reflects the mechanism described by the vendor rather than a confirmed released PoC.