Remote Code Execution Vulnerability in NextGEN Gallery Plugin for WordPress

CVE-2026-76012

What is CVE-2026-76012?

The NextGEN Gallery plugin for WordPress contains a vulnerability that permits remote code execution. This issue arises due to broken authorization on the Lightroom gallery_edit endpoint and flaws in handling file uploads. The plugin allows attackers with custom-level access to exploit the legacy_render function, enabling them to upload malicious code via a misconfigured template directory. Specifically, the extension check for uploaded files is flawed, accepting sanitized .php_ filenames as valid. To exploit this vulnerability, an attacker must be recognized as the author of at least one existing gallery. The combination of these factors makes it feasible for authenticated users to gain unauthorized access and execute arbitrary code on the web server.

References