CVE-2026-94123: WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability
Published Sep 30, 2026
·Updated
Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
Affected Software
1 affected component
Imagely NextGEN Gallery<=4.5.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress NextGEN Gallery Pluginto a version that resolves this vulnerability.Fixed in 4.5.1
Event History
Sep 30, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is unauthenticated and remotely exploitable, so an attacker does not need a WordPress account or other prior privileges.
2
What is the potential impact?
Successful exploitation can allow arbitrary file download, with a high confidentiality impact. The supplied scoring indicates no integrity or availability impact.
3
Which installations are affected?
Imagely NextGEN Gallery versions 4.5.0 and earlier are identified as affected. The provided data does not state whether any particular WordPress or plugin configuration is required.