CVE-2026-81652: NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0's own capability-gated read path reserves to administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with the Contributor role or a higher role can request metadata for image records they are not entitled to access, including images in galleries owned by other users.
What information can be disclosed?
The exposed metadata includes a stored EXIF subset with camera make and model and capture timestamp, plus internal checksums and identifiers. The plugin’s intended capability-gated read path reserves some of this information to administrators.
Are anonymous visitors affected?
The available information describes exploitation by users with the Contributor role and above. It does not state that unauthenticated visitors can access the affected image metadata.
How can I determine whether an installation is affected?
Installations running the plugin before version 4.5.0 are affected. The issue involves metadata requests for image records where the requesting Contributor-or-higher user does not own or otherwise have entitlement to the target image.