{
 "id": "WPSEC-2026-1127",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1127/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1127/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1127/index.md",
 "title": "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.2 - Authenticated (Contributor+) Local File Inclusion via Shortcode Attributes",
 "description": "The NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion via gallery shortcode attributes in all versions up to, and including, 4.5.2. Shortcode attributes are passed into the template variable set, which is extract()ed with overwriting enabled immediately before the template include, so an attribute named like the internal template path variable replaces the validated path. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary PHP files on the server, which can be used to bypass access controls, obtain sensitive data, or achieve code execution where files of an executable type can be uploaded or already exist on the server.",
 "plugin": {
  "slug": "nextgen-gallery",
  "name": "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery",
  "full_name": "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery",
  "wordpress_org": "https://wordpress.org/plugins/nextgen-gallery/",
  "advisories_url": "https://wpsec.com/vuln/plugin/nextgen-gallery/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/nextgen-gallery"
 },
 "type": "LFI",
 "cwe": [
  "CWE-98"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.8,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.5.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.5.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.5.3",
 "remediation": "Update to 4.5.3 or later.",
 "fix_released": "2026-10-15T18:06:31+00:00",
 "published": "2026-10-16T18:43:17+00:00",
 "updated": "2026-10-16T09:49:46.155871+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1127/",
  "https://plugins.svn.wordpress.org/nextgen-gallery/tags/4.5.3/",
  "https://wordpress.org/plugins/nextgen-gallery/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/nextgen-gallery",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-16"
 }
}