Summary
A Remote Code Execution (RCE) vulnerability, CVE-2026-76010, affects the Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin. This vulnerability impacts all versions up to and including 4.4.1. The issue is addressed in version 4.5.0 of the plugin. There is no evidence of active exploitation at this time.
Affected and patched versions
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery (plugin nextgen-gallery): affected 4.4.1 and earlier; fixed in 4.5.0
Is my site vulnerable?
To determine if your WordPress site uses a vulnerable version of the NextGEN Gallery plugin, check the installed version number.
Access your WordPress administration dashboard. Navigate to the "Plugins" section and select "Installed Plugins". Locate "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery" in the list. The version number is displayed next to the plugin name. If the installed version is 4.4.1 or earlier, your site is exposed to this vulnerability.
Alternatively, you can check the plugin's readme.txt file via FTP or your hosting file manager. This file is typically located in wp-content/plugins/nextgen-gallery/readme.txt. Open this file and look for the "Stable tag" or "Version" entry, which indicates the installed plugin version. Compare this version number against the patched version to assess your site's status.
What an attacker actually does
CVE-2026-76010 allows an authenticated attacker to execute arbitrary code on a server running the NextGEN Gallery plugin. This vulnerability is classified as Authenticated Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal. The core of the issue lies in how the plugin handles image metadata and constructs file paths.
The vulnerability arises from several combined factors. First, the plugin permits unrestricted mass assignment of caller-supplied meta_data keys onto the image model. This means an attacker can provide arbitrary data fields that the plugin then assigns to an image object without sufficient validation. For example, an attacker could supply a meta_data key that points to a file path. Second, there is a lack of realpath containment during path construction. This absence allows an attacker to manipulate file paths, enabling path traversal attacks where files can be written or accessed outside their intended directories within the server's file system. Finally, a signature check on the public image delivery route can be bypassed, completing the chain of vulnerabilities that leads to code execution.
An attacker requires at least custom-level access to exploit this flaw. This condition can be met if a user, even a Subscriber, was previously granted the 'NextGEN Manage gallery' capability. Crucially, this access can be retained indefinitely because of a stored gallery-author equality fallback in the _can_manage_gallery() function, even if the capability is later revoked. With this access, the attacker can craft malicious meta_data through XML-RPC requests. This crafted data, processed by the render_image function, leverages the mass assignment and path traversal weaknesses to write malicious code to a location on the server. The bypassable signature check then allows this malicious code to be executed, leading to full Remote Code Execution. This grants the attacker control over the compromised server.
How to detect a compromise
Detecting a compromise resulting from Remote Code Execution (RCE) often involves looking for unexpected files, unauthorized modifications, or unusual server activity. Since this vulnerability allows an attacker to execute arbitrary code, the indicators can vary widely depending on the attacker's objectives and the specific payload deployed.
Inspect your WordPress installation for any unfamiliar files, particularly PHP files, in directories where they should not exist. Common targets for RCE payloads include the wp-content/uploads/ directory, other plugin directories, or even the root of your WordPress installation. Attackers might place web shells or backdoors to maintain persistence. Look for files with suspicious names or recent modification dates that do not correspond to legitimate plugin or theme updates. Pay close attention to files related to image processing or gallery functions, as these might be directly implicated by the vulnerability's nature.
Examine your server's access logs and error logs for unusual requests or errors. Look for requests to newly created or modified files, especially those with .php extensions in unexpected locations. Pay attention to requests originating from unusual IP addresses or user agents, or repeated attempts to access non-existent files that might indicate reconnaissance or post-exploitation activity. Unexpected outbound network connections from your web server could also signal a compromise.
You can use command-line tools if you have SSH access to your server. For example, to search for recently modified PHP files in your wp-content directory, you might use a command like: find /path/to/your/wordpress/wp-content -name "*.php" -mtime -7 -ls This command searches for PHP files modified within the last seven days. Adjust the path and mtime value as needed. Look for files that do not belong to legitimate plugins or themes. Similarly, you can use grep to search for suspicious strings (e.g., eval(, base64_decode(, shell_exec() within PHP files, though this requires careful analysis to distinguish malicious code from legitimate plugin functions.
Review your WordPress database for any unauthorized changes, such as new administrative users, modified user roles, or altered plugin settings that you did not initiate. While direct database manipulation is not the primary vector of this RCE, a successful RCE often leads to further compromise, including database modifications to establish persistence or escalate privileges.
How to fix
The most direct and effective way to address CVE-2026-76010 is to update the NextGEN Gallery plugin to a patched version.
Backup your site: Before performing any updates, create a complete backup of your WordPress files and database. This ensures you can restore your site if any issues arise during the update process.
Update the plugin: Log in to your WordPress administration dashboard. Navigate to "Plugins" and then "Installed Plugins". Locate "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery". If an update is available, a notification will appear. Click "Update Now" to install the latest version. The patched version is 4.5.0.
Verify the update: After the update completes, confirm that the plugin version displayed in your "Installed Plugins" list is 4.5.0 or higher.
Clear caches: If you use caching plugins or server-level caching, clear all caches after the update to ensure the new plugin files are served correctly.
Monitor your site: After updating, continue to monitor your site for any unusual activity or performance issues.
If you are unable to update immediately, consider temporarily deactivating the NextGEN Gallery plugin to mitigate the risk. However, this will disable its functionality on your site. Updating to version 4.5.0 or later is the recommended long-term solution.
Timeline
Date | Event |
|---|---|
2026-09-16 | Patch released |
2026-10-31 | NVD entry published |