EUVD-2026-89840
GHSA-j35h-prj2-f2v7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running NextGEN Gallery ≤4.5.0
-
DeliverySend crafted request with traversal path parameter
-
ExploitBypass path validation in download handler
-
ExecutionServer returns arbitrary local file
-
ImpactExfiltrate wp-config.php credentials and secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the NextGEN Gallery WordPress plugin at versions <= 4.5.0 (PR:N/UI:N/AC:L). The only prerequisites are a reachable WordPress site with the vulnerable plugin active and the download endpoint accessible over the network. Limiting factors: impact is bounded to files readable by the web server process (confidentiality only, no write or code execution), and exposure ends once the site is updated past 4.5.0; sites without the plugin installed or already patched are unaffected. |
| Impact | This is a genuine priority, not a paper-tiger high-CVSS issue. The Patchstack-sourced CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) describes the highest-exposure profile for a web flaw: network-reachable, low-complexity, no privileges, no user interaction. Impact is confidentiality-only (C:H, I:N, A:N), consistent with an arbitrary file DOWNLOAD (read/exfiltration) rather than write or code execution - so the 7.5 is honest, not inflated. No EPSS score, KEV entry, SSVC decision, or public POC was supplied in the input, so exploitation status is 'no public exploit identified at time of analysis' based on the data provided; the absence of these signals does not lower the intrinsic risk given how trivially reachable path-traversal file-download bugs are and the plugin's very large install base. The main tempering factor is the impact ceiling: an attacker can read files the web server can access (e.g., wp-config.php with DB credentials and secret keys) but cannot directly modify data or run code through this bug alone. Verify affected/fixed versions and any Patchstack POC directly, since the single reference is a database landing page. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to the NextGEN Gallery download/AJAX endpoint with a manipulated path parameter containing directory-traversal sequences, causing the plugin to serve an arbitrary server-side file such as wp-config.php. The attacker retrieves database credentials, WordPress salts/keys, and other secrets, enabling deeper compromise. No POC was included in the provided intelligence, but the flaw class is trivially exploitable given AC:L/PR:N/UI:N. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated arbitrary file download in the NextGEN Gallery WordPress plugin affects every site running version 4.5.0 or earlier, allowing a remote attacker with no credentials required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, base score 7.5) to retrieve files that are readable by the web server process. Rooted in a path-traversal weakness (CWE-22) in the plugin's file download handling, the impact is confined to confidentiality - typical targets are wp-config.php, database credentials, environment files, and backup archives - with no file write or code execution. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, though the reachable default-configuration attack path makes it a genuine priority rather than a paper-tiger high-CVSS issue.
RemediationAI
Upgrade NextGEN Gallery to a build newer than 4.5.0 - the vulnerable range is explicitly defined as <= 4.5.0, and the exact fixed release number is not specified in the available intelligence, so deploy the latest available version and confirm the fix against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/nextgen-gallery/vulnerability/wordpress-nextgen-gallery-plugin-4-5-0-arbitrary-file-download-vulnerability?_s_id=cve) before considering sites remediated; no vendor-released patch version is independently confirmed here. If immediate updating is not possible, deactivate or uninstall the plugin on sites that do not need it, accepting the loss of gallery functionality; alternatively apply a virtual patch at the WAF or reverse proxy that blocks traversal sequences (including percent-encoded and double-encoded variants such as %2e%2e, ..%2f, and %252e%252e) on the plugin's download route, recognizing that parser discrepancies between the WAF and PHP can allow bypasses. Restricting the download endpoint to trusted networks or requiring authentication at the proxy where public downloads are not needed removes the exposure entirely at the cost of that feature. Because the flaw is confidentiality-only, treat any pre-patch exposure as a possible credential disclosure and rotate WordPress salts, database credentials, and any secrets stored in files readable by the web server process.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NextGEN Gallery is a widely deployed WordPress plugin for gallery and image management, and the CPE record cpe:2.3:a:syed_balkhi:nextgen_gallery identifies the affected codebase from the plugin author syed_balkhi. The vulnerability class is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): a download endpoint accepts a file path parameter and reads the referenced file without adequate canonicalization or an allow-list restriction, so directory traversal sequences let a request escape the intended gallery directory and reach other paths on the host. Because the code runs as PHP inside the WordPress web server process, the blast radius is bounded by filesystem permissions granted to that process - typically the WordPress document root and any readable configuration, log, or backup files. Exploitation requires only that the plugin be active and the download endpoint be network-reachable; default configurations satisfy that condition, and no authentication or user interaction is needed (PR:N/UI:N). The flaw is read-only, so it enables information disclosure such as database credentials in wp-config.php rather than direct remote code execution.
Know when Nextgen Gallery gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network request with no interaction (AV:N/AC:L/PR:N/UI:N); arbitrary file read gives high confidentiality impact but no integrity or availability effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
Executive ViewAI
Every WordPress site running NextGEN Gallery 4.5.0 or earlier - including any externally reachable galleries - can be forced by an anonymous internet user to disclose files readable by the web server process, with no credentials or user interaction required. The realistic prize is wp-config.php, database credentials, environment files, and backup archives, meaning a single successful request could yield the keys to the site's backend and any connected data stores. Leadership should treat this as an urgent exposure-reduction problem rather than a routine maintenance item, because no vendor fix is currently available and the attack path works against default deployments.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the NextGEN Gallery plugin where not required; front affected sites with WAF/reverse-proxy virtual patching that blocks path-traversal payloads on the plugin's download endpoint (or blocks that endpoint entirely); restrict the web server process's filesystem read scope via permissions and open_basedir; ensure wp-config.php, environment files, and backup archives are stored outside the web root; rotate exposed credentials and secrets; and monitor logs for anomalous download requests and reads of sensitive files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Nextgen Gallery
View allThe WordPress Gallery Plugin - NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to
The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to PHAR Deserialization due to a lack of input p
The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack
Unauthenticated cross-site scripting in the NextGEN Gallery WordPress plugin (versions <= 4.2.3) allows a remote, unauth
In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_i
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.3 does not sanitise and escape some of its setting
In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via
A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Rated critical s
Authenticated SQL injection in NextGEN Gallery (WordPress plugin by Awesome Motive/Imagely) before version 4.2.1 allows
The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to g
In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images
Exploit-DB