What the vulnerability does
01Description
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.3 via the 'template' parameter in gallery shortcodes. This makes it possible for authenticated attackers, with Author-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Explanation of Vulnerability in Simple Terms
02Summary
NextGEN Gallery versions up to 4.0.4 contain a vulnerability that allows authenticated users with low privileges to read sensitive data, modify site content, and disrupt service. The vulnerability requires network access and an active user account but no additional user interaction. Site administrators should update to a version newer than 4.0.4 immediately.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify content, and disrupt site availability with a low-privilege user account.
Potential impact on your site
04Site Impact
Authenticated users can access confidential information, alter gallery content, and cause service disruptions.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
06Disclosure timeline
March 18, 2026
CVE published
April 8, 2026
Record updated
