WORDFENCE-47fb0513-bebe-4e09-9402-d7e174ee92ce high

Description

The NextGen Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the is_image_file function in versions up to, and including, 2.0.65. This makes it possible for authenticated attackers with upload privileges to upload arbitrary files on the affected sites server which may make remote code execution possible. Affected software — plugin: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery (affected: *-2.0.65). CVSS 8.8 (High) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Indicators of Compromise (0)

No indicators of compromise on this threat.

References (2)

• Wordfence vulnerability detail Wordfence
• https://www.wordfence.com/threat-intel/vulnerabilities/id/47fb0513-bebe-4e09-9402-d7e174ee92ce?source=api-prod Wordfence

• Wordfence remediation: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
  Wordfence

  Update to version 2.0.66, or a newer patched version

  2026-06-06 16:04 UTC

Only Available for Registered Users. Sign in to view.