PT-2026-42112 · WordPress · Nextgen Gallery

Bao Luu Gia Nguyen · Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-6566

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions NextGEN Gallery versions prior to 4.2.1

Description The NextGEN Gallery plugin for WordPress contains an Insecure Direct Object Reference issue. This occurs due to insufficient object-level authorization within the image deletion REST flow. Specifically, the permission callback for the endpoint 'DELETE /imagely/v1/images/{id}' only verifies 'NextGEN Manage gallery' permissions and fails to enforce gallery ownership or 'NextGEN Manage others gallery' permissions. Consequently, authenticated attackers with Subscriber-level privileges and the 'NextGEN Manage gallery' capability can delete images belonging to other users, including the associated image files from the disk, provided that deleteImg is enabled.

Recommendations Update the plugin to a version later than 4.2.0. As a temporary workaround, disable the deleteImg setting to prevent the deletion of image files from the disk.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-6566

Affected Products

Nextgen Gallery

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-6566 · Security Note
• https://plugins.trac.wordpress.org/changeset/3533432/nextgen-gallery · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/439809ad-21ea-4a0b-b1fd-5de9f8f5ee7a?source=cve · Note
• https://t.me/CVEtracker/54357 · Telegram Post