PT-2026-26087 · WordPress · Nextgen Gallery

Athiwat Tiprasaharn + 2 · Published 2026-03-18 · Updated 2026-03-19 · CVE-2026-1463

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NextGEN Gallery versions prior to 4.0.4

Description The NextGEN Gallery plugin for WordPress is susceptible to a Local File Inclusion issue. This affects versions up to and including 4.0.3. The issue is triggered through the template parameter within gallery shortcodes. Successful exploitation allows authenticated attackers with Author-level access or higher to include and execute arbitrary .php files on the server. This can lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .php files can be uploaded and included. The vulnerable parameter is template.

Recommendations Update NextGEN Gallery to version 4.0.4 or later.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-1463

Affected Products

Nextgen Gallery

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-1463 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2d7bc556-cdaf-42a7-8801-ad2e4945a137?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3460327/nextgen-gallery/trunk/src/DisplayType/LegacyTemplateLocator.php?old=3423202&old_path=nextgen-gallery%2Ftrunk%2Fsrc%2FDisplayType%2FLegacyTemplateLocator.php · Note
• https://twitter.com/CVEnew/status/2034365275286716734 · Twitter Post
• https://twitter.com/TheHackerWire/status/2034320904545783883 · Twitter Post
• https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.0.3/src/DisplayType/Controller.php#L369 · Note
• https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.0.3/src/DisplayType/LegacyTemplateLocator.php#L140 · Note
• https://twitter.com/RedPacketSec/status/2034433170934730895 · Twitter Post
• https://twitter.com/CveFindCom/status/2034324669470331350 · Twitter Post