Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-76010— Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal

Quick assessment

Affected
smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的"Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery"插件在所有 4.4.1 及之前的版本中，由于 函数存在缺陷，可被利用实施远程代码执行（RCE）。该漏洞源于以下三个问题的组合： 1. 允许调用方提供的 键被无限制地批量赋值到图像模型； 2. 在路径构建过程中缺少 约束； 3. 公共图像交付路由上的签名验证可被绕过。 具备自定义（Custom）级别及以上权限的已认证攻击者，可利用此漏洞在服务器上执行任意代码。利用该漏洞需

CVSS 8.8 · High EPSS 1.13% · P66

Affected Version Matrix 1

VendorProduct Version RangeStatus
smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery ≤ 4.4.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-76010

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal
Source: CVE Program / CVE List V5
Vulnerability Description
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery 0 ~ 4.4.1 -

II. Public POCs for CVE-2026-76010

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-76010

请登录查看更多情报信息。

Other References for CVE-2026-76010 (8)

Same Patch Batch · smub · 2026-10-31 · 3 CVEs total

CVE-2026-116563 5.4 MEDIUM Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cr
CVE-2026-109367 5.3 MEDIUM All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Q

IV. Related Vulnerabilities

Same product: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Same vendor: smub
Same weakness: CWE-434