Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-76012— Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload

Quick assessment

Affected
smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 NextGEN Gallery 插件（包含 Photo Gallery、Sliders、Proofing 和 Themes 功能）在所有 4.4.1 及更早版本中，因 函数存在远程代码执行（RCE）漏洞。该漏洞源于 Lightroom 的 端点授权机制失效，同时结合了对画廊路径的大规模赋值（mass assignment）以及向已注册的模板目录中上传文件的限制缺失；该目录的文件扩展名检查采用子串匹配方式，导致经清理后的 文件名被误判为有效模板。因此，拥有自定义级别（custom-level）

CVSS 7.5 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery ≤ 4.4.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-76012

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload
Source: CVE Program / CVE List V5
Vulnerability Description
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy_render function. This is due to broken authorization on the Lightroom gallery_edit endpoint combined with mass assignment of gallery path and unrestricted file upload into a registered template directory, whose extension check uses a substring match that accepts sanitized .php_ filenames as valid templates. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to be the stored author of at least one existing NextGEN gallery, as ownership of that gallery is the sole authorization check gating the mass-assignment and upload steps.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery 0 ~ 4.4.1 -

II. Public POCs for CVE-2026-76012

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-76012

请登录查看更多情报信息。

Other References for CVE-2026-76012 (8)

IV. Related Vulnerabilities

Same product: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Same vendor: smub
Same weakness: CWE-434