CVE-2026-81654: NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NextGEN Galleryto a version that resolves this vulnerability.Fixed in 4.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A user must be authenticated and have the plugin's gallery-management capability, which an administrator may grant. Users without that capability are not described as able to change the affected settings.
What is the impact of successful exploitation?
The user can modify image sizing settings that apply across the entire site, despite not holding the plugin's options capability. This can affect how images are sized site-wide.
Are affected sites vulnerable by default?
Exploitation depends on an administrator having granted a user the plugin's gallery-management capability while not intending that user to manage plugin options. The available data does not state whether this capability is assigned to any role by default.
What can be done before upgrading?
Review accounts and roles that have the plugin's gallery-management capability, and remove that capability from users who should not be able to alter site-wide image settings. Upgrade the plugin to version 4.5.0 or later when possible.