What is the CVSS score of EUVD-2026-31063?

EUVD-2026-31063 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

NextGEN Gallery EUVD-2026-31063

| CVE-2026-6566 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-20 Wordfence

GHSA-4hjj-956w-4cwm

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 07:02 vuln.today

DescriptionCVE.org

The Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. This is due to insufficient object-level authorization in the image deletion REST flow where the permission callback for DELETE /imagely/v1/images/{id} only checks 'NextGEN Manage gallery' permissions and does not enforce gallery ownership or 'NextGEN Manage others gallery' permissions. This makes it possible for authenticated attackers, with Subscriber-level privileges and 'NextGEN Manage gallery' capability, to delete gallery images belonging to other users as well as their associated image files from disk when deleteImg is enabled (default).

AnalysisAI

Insecure Direct Object Reference in NextGEN Gallery WordPress plugin through version 4.2.0 allows authenticated attackers with Subscriber-level privileges and the 'NextGEN Manage gallery' capability to delete gallery images belonging to other users, including their physical files from disk. The DELETE /imagely/v1/images/{id} REST endpoint validates only the 'NextGEN Manage gallery' capability, entirely omitting gallery ownership checks and the 'NextGEN Manage others gallery' permission - making cross-user image destruction possible at low privilege. No public exploit code identified at time of analysis and no CISA KEV listing; however, when deleteImg is enabled (default), exploitation results in irreversible file-level data loss beyond what the CVSS 4.3 integrity score alone conveys.

Technical ContextAI

The vulnerability affects the WordPress REST API layer of the NextGEN Gallery plugin (CPE: cpe:2.3:a:smub:photo_gallery,_sliders,_proofing_and_themes_-_nextgen_gallery:*:*:*:*:*:*:*:*), published by SMUB. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the REST permission callback for DELETE /imagely/v1/images/{id} accepts a caller-controlled image ID and checks only whether the requester holds 'NextGEN Manage gallery' capability, never validating that the target image belongs to the requesting user's gallery, nor requiring the elevated 'NextGEN Manage others gallery' capability that should govern cross-gallery operations. Because the image ID is an integer predictable or enumerable from the gallery frontend, an attacker can trivially target records outside their own scope. When the plugin's deleteImg option is active - its default state - the deletion also removes the underlying image file from the server filesystem, escalating the impact from a logical record deletion to permanent file destruction.

RemediationAI

Update the NextGEN Gallery plugin to a version beyond 4.2.0 that incorporates the fix from Trac changeset 3533432 (https://plugins.trac.wordpress.org/changeset/3533432/nextgen-gallery); since the exact patched release version is not independently confirmed from available data, verify the current stable version in the WordPress plugin repository before deploying. As an immediate compensating control prior to patching, administrators should audit all user accounts holding the 'NextGEN Manage gallery' capability via WordPress role management and revoke it from any Subscriber-level accounts that do not require it - this directly eliminates the exploitation path since the capability is not default-assigned. Additionally, disabling the 'deleteImg' option in NextGEN Gallery settings will prevent physical file deletion from disk if exploitation occurs, preserving image files even if logical deletion of database records succeeds; note that this workaround does not block unauthorized record deletion and may affect intended gallery cleanup workflows. No side effects are expected from the capability audit beyond restricting low-privilege gallery management operations.