CVE-2026-1463: NextGEN Gallery WordPress Plugin RCE Flaw

CVE-2026-1463 Overview

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to, and including, 4.0.3 via the template parameter in gallery shortcodes. This vulnerability allows authenticated attackers with Author-level access and above to include and execute arbitrary .php files on the server, enabling the execution of any PHP code contained in those files. This can be exploited to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

Critical Impact

Authenticated attackers can achieve arbitrary PHP code execution on affected WordPress installations, potentially leading to complete site compromise, data theft, and unauthorized access to sensitive server resources.

Affected Products

• NextGEN Gallery WordPress Plugin versions up to and including 4.0.3
• WordPress installations with NextGEN Gallery plugin enabled
• Sites allowing Author-level or higher user access

Discovery Timeline

• 2026-03-18 - CVE CVE-2026-1463 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-1463

Vulnerability Analysis

This Local File Inclusion vulnerability exists in the NextGEN Gallery plugin's handling of template parameters within gallery shortcodes. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), indicating that user-supplied input is insufficiently validated before being used in PHP include or require statements.

The attack requires network access and authenticated access at the Author level or above, but does not require user interaction. Successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected WordPress installation.

Root Cause

The vulnerability stems from improper input validation in the LegacyTemplateLocator.php component of the NextGEN Gallery plugin. The template parameter passed through gallery shortcodes is not adequately sanitized before being used to locate and include template files. This allows attackers to manipulate the file path to include arbitrary PHP files present on the server.

The vulnerable code path involves the Controller.php and LegacyTemplateLocator.php files, where user-controlled template values can be leveraged to traverse directories and include files outside the intended template directories.

Attack Vector

The attack leverages the network-accessible WordPress interface to exploit the template parameter in NextGEN Gallery shortcodes. An attacker with at least Author-level privileges can craft malicious shortcodes that specify arbitrary file paths in the template parameter.

The exploitation follows this pattern: First, the attacker uploads a malicious PHP file through WordPress's media upload functionality (if allowed) or identifies existing PHP files on the server. Next, they create or edit a post containing a NextGEN Gallery shortcode with a manipulated template parameter pointing to the target PHP file. When the post is rendered, the vulnerable code includes and executes the specified PHP file, allowing arbitrary code execution with the privileges of the web server process.

For detailed technical analysis of the vulnerable code paths, refer to the WordPress NextGEN Gallery Code Snippet and Legacy Template Locator in the WordPress plugin repository.

Detection Methods for CVE-2026-1463

Indicators of Compromise

• Unusual file access patterns in web server logs targeting PHP files outside the NextGEN Gallery template directories
• POST requests or shortcode content containing path traversal sequences (../, ..%2f) in the template parameter
• New or modified PHP files in unexpected locations on the WordPress installation
• Unexpected process spawning from the web server process (PHP execution artifacts)

Detection Strategies

• Monitor web application firewall (WAF) logs for path traversal attempts targeting NextGEN Gallery endpoints
• Implement file integrity monitoring on critical WordPress directories to detect unauthorized PHP file additions
• Review WordPress audit logs for suspicious shortcode creation or modification by Author-level users
• Deploy intrusion detection rules to flag requests containing LFI patterns in gallery shortcode parameters

Monitoring Recommendations

• Enable verbose logging for the NextGEN Gallery plugin and monitor for template loading errors or unusual template paths
• Configure SIEM alerts for patterns matching Local File Inclusion attack signatures targeting WordPress installations
• Regularly audit user accounts with Author-level or higher privileges for unauthorized access or suspicious activity
• Implement real-time file system monitoring on WordPress installations to detect runtime PHP file creation

How to Mitigate CVE-2026-1463

Immediate Actions Required

• Update the NextGEN Gallery plugin to a version newer than 4.0.3 that includes the security patch
• Review and restrict user accounts with Author-level or higher privileges to trusted individuals only
• Audit recent posts and pages for suspicious shortcode content that may indicate exploitation attempts
• Temporarily disable the NextGEN Gallery plugin if immediate patching is not possible

Patch Information

The vulnerability has been addressed in an update to the NextGEN Gallery plugin. The security patch modifies the LegacyTemplateLocator.php file to properly validate and sanitize the template parameter, preventing path traversal and arbitrary file inclusion. The specific changes can be reviewed in the WordPress NextGEN Gallery Changeset. Additional vulnerability details are available in the Wordfence Vulnerability Intelligence Report.

Workarounds

• Restrict Author-level access to only trusted users who require post creation capabilities
• Implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences in NextGEN Gallery parameters
• Disable PHP file uploads through WordPress media library if not required
• Configure server-level restrictions using open_basedir to limit PHP file inclusion scope

# Apache .htaccess configuration to block path traversal attempts
<IfModule mod_rewrite.c>
    RewriteEngine On
    # Block requests with path traversal patterns
    RewriteCond %{QUERY_STRING} (\.\./) [NC,OR]
    RewriteCond %{QUERY_STRING} (\.\.%2f) [NC]
    RewriteRule .* - [F,L]
</IfModule>