# Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.2 - Authenticated (Author+) Insecure Direct Object Reference to Album Modification and Deletion via Lightroom and XML-RPC

- **ID:** WPSEC-2026-1126
- **Plugin:** Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery (`nextgen-gallery`), https://wordpress.org/plugins/nextgen-gallery/
- **Affected versions:** all versions before 4.5.3
- **Fixed in:** 4.5.3 (Update to 4.5.3 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/nextgen-gallery
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1126/

## Description

The NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 due to missing album ownership validation on the Lightroom album_edit/album_remove tasks and the XML-RPC album edit and delete methods. This makes it possible for authenticated attackers who have been granted the 'NextGEN Edit album' capability (such as delegated author-level users) to rename, modify, or permanently delete albums belonging to other users.

## References

- https://wpsec.com/vuln/WPSEC-2026-1126/
- https://plugins.svn.wordpress.org/nextgen-gallery/tags/4.5.3/
- https://wordpress.org/plugins/nextgen-gallery/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1126/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.