CVE-2026-118191: Photo Gallery, Sliders, Proofing and Themes <= 4.5.5 - Authenticated (Custom+) Arbitrary File Deletion via 'task_list' and 'app_config' Parameters
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handlejob function in all versions up to, and including, 4.5.5 This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The 'NextGEN Manage gallery' capability required to reach the vulnerable endpoint is granted to Administrators by default but can be delegated to lower-privileged roles via the plugin's Roles screen.
Affected Software
Event History
Frequently Asked Questions
Which WordPress roles are exposed by default?
Administrators are granted the required "NextGEN Manage gallery" capability by default. Lower-privileged roles are affected only if that capability has been delegated through the plugin's Roles screen.
What access does an attacker need to exploit this issue?
An attacker needs an authenticated WordPress account with custom-level access or higher and the "NextGEN Manage gallery" capability. No user interaction is required.
What could exploitation allow an attacker to do?
An attacker can delete arbitrary files on the server through the vulnerable endpoint. Deleting an important file such as wp-config.php can potentially lead to remote code execution.
How can I determine whether my site may be affected?
Sites running NextGEN Gallery version 4.5.5 or earlier may be affected. Review the plugin's Roles screen to identify any non-administrator roles that have been granted the "NextGEN Manage gallery" capability.