- Son 7 gün
- CWE-434
CVE-2026-76010
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Executio…
smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
- Yayımlandı
- Güncellendi
- 31 Eki 2026
- Açık yaşı
- 0 gün
- Kaydı açan
- Wordfence
Özet
Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.
Etkilenen sürümler1 yazılım
| Yazılım | Etkilenen | Düzeltildiği sürüm |
|---|---|---|
| smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | ≤ 4.4.1 | – |
Kaynaklar10 kaynak
- CVE.org kaydı
- NVD kaydı
- wordfence.com/…lities/id/36dcde20-0af2-4b8b-8637-9a070dffa8a1 Diğer
- plugins.trac.wordpress.org/…gallery/tags/4.3.0/src/DataStorage/Manager.php Diğer
- plugins.trac.wordpress.org/…n-gallery/tags/4.3.0/src/XMLRPC/Controller.php Diğer
- plugins.trac.wordpress.org/…gallery/tags/4.3.0/src/DataStorage/Manager.php Diğer
- plugins.trac.wordpress.org/…ags/4.3.0/src/DynamicThumbnails/Controller.php Diğer
- plugins.trac.wordpress.org/…n-gallery/tags/4.3.0/src/XMLRPC/Controller.php Diğer
- plugins.trac.wordpress.org/…gallery/tags/4.3.0/src/DataStorage/Manager.php Diğer
- plugins.trac.wordpress.org/…tgen-gallery/trunk/src/DataStorage/Manager.php Diğer
Kayıt geçmişi
- Yayımlandı