CVE-2026-81651: NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path, and including galleries belonging to other users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has been granted NextGEN Gallery's gallery-management capability by an administrator can exploit it. The issue does not require the user to own the target gallery.
What can an attacker change?
The attacker can overwrite stored settings for any gallery on the site, including galleries owned by other users. This includes the gallery's filesystem path.
Are default WordPress users affected?
The available information only identifies users granted the plugin's gallery-management capability as affected. It does not state which WordPress roles receive that capability by default.
What should be done if immediate patching is not possible?
Restrict the plugin's gallery-management capability to only fully trusted users, since any user with that capability can modify settings for other users' galleries. Review gallery settings, especially filesystem paths, for unexpected changes.
How can administrators identify possible exploitation?
Review stored settings for galleries belonging to each user and look for unauthorized changes, particularly changes to filesystem paths. The provided information does not identify specific log entries or indicators of compromise.