Local File Inclusion in NextGEN Gallery Plugin for WordPress

CVE-2025-13641

What is CVE-2025-13641?

The NextGEN Gallery plugin for WordPress has a Local File Inclusion vulnerability that affects all versions up to and including 3.59.12. This security flaw arises from inadequate path validation in the 'template' shortcode parameter, allowing attackers with Contributor-level access and above to introduce absolute paths. As a result, it becomes feasible for authorized attackers to include and execute arbitrary PHP files on the server. This exploitation can circumvent standard web server security measures, such as .htaccess, potentially leading to sensitive information leakage, unauthorized code execution within the WordPress environment, and even remote code execution risks when coupled with capabilities for arbitrary file uploads.

References