{
 "id": "WPSEC-2026-1125",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1125/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1125/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1125/index.md",
 "title": "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.2 - Authenticated (Contributor+) PHP Object Injection via Shortcode Template Attribute",
 "description": "The NextGEN Gallery plugin for WordPress is vulnerable to PHP Object Injection via the template shortcode attribute and import folder paths in all versions up to, and including, 4.5.2 due to stream-wrapper paths such as phar:// not being rejected before they reach file_exists() when resolving relative template names. This makes it possible for authenticated attackers, with contributor-level access and above, to trigger deserialization of the metadata of an attacker-supplied Phar archive on sites running PHP 7.4 or earlier. No known POP chain is present in the plugin itself; if a POP chain is present via an additional plugin or theme, this could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
 "plugin": {
  "slug": "nextgen-gallery",
  "name": "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery",
  "full_name": "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery",
  "wordpress_org": "https://wordpress.org/plugins/nextgen-gallery/",
  "advisories_url": "https://wpsec.com/vuln/plugin/nextgen-gallery/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/nextgen-gallery"
 },
 "type": "OBJECT INJECTION",
 "cwe": [
  "CWE-502"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.5.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.5.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.5.3",
 "remediation": "Update to 4.5.3 or later.",
 "fix_released": "2026-10-15T18:06:31+00:00",
 "published": "2026-10-16T18:43:17+00:00",
 "updated": "2026-10-16T09:49:46.155871+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1125/",
  "https://plugins.svn.wordpress.org/nextgen-gallery/tags/4.5.3/",
  "https://wordpress.org/plugins/nextgen-gallery/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/nextgen-gallery",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-17"
 }
}