Vulnerabilities / Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery / WPSEC-2026-1126
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.2 - Authenticated (Author+) Insecure Direct Object Reference to Album Modification and Deletion via Lightroom and XML-RPC
Medium 5.4
CWE-639Fixed in 4.5.3
- ID
- WPSEC-2026-1126
- Plugin
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery (nextgen-gallery)
- Affected
- all versions before 4.5.3
- Remediation
- Update to 4.5.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery on WPSec AttackSurface
- Fix released
- Published
Description
The NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 due to missing album ownership validation on the Lightroom album_edit/album_remove tasks and the XML-RPC album edit and delete methods. This makes it possible for authenticated attackers who have been granted the 'NextGEN Edit album' capability (such as delegated author-level users) to rename, modify, or permanently delete albums belonging to other users.
References
- https://wpsec.com/vuln/WPSEC-2026-1126/
- https://plugins.svn.wordpress.org/nextgen-gallery/tags/4.5.3/
- https://wordpress.org/plugins/nextgen-gallery/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS