CVE-2026-76010

Summary

The NextGEN Gallery plugin for WordPress allows authenticated attackers with custom-level access or higher to execute arbitrary code on the server due to unrestricted mass assignment of meta_data keys onto the image model, missing realpath containment in path construction, and a bypassable signature check on the public image delivery route.

Exploitability

Exploitation requires an authenticated attacker who owns at least one NextGEN gallery, which can be obtained by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability—even after revocation—due to a stored gallery-author equality fallback in _can_manage_gallery().

Blast radius

Successful exploitation allows full server compromise including data exfiltration, lateral movement, and persistence for authenticated attackers with low privileges.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to NextGEN Gallery version 4.4.2 or later, which addresses the mass assignment, realpath containment, and signature bypass issues.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.