CVE-2026-1463 - Vulnerability Analysis

Overview

NextGEN Gallery WordPress plugin <= 4.0.3 contains a local file inclusion vulnerability caused by improper validation of the 'template' parameter in gallery shortcodes, letting authenticated attackers with Author-level access execute arbitrary PHP files on the server.

Severity & Score

Impact

Authenticated attackers can execute arbitrary PHP code, bypass access controls, and obtain sensitive data, potentially leading to full server compromise.

Mitigation

Update to the latest version of NextGEN Gallery plugin.

References

• https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.0.3/src/DisplayType/Controller.php#L369
• https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.0.3/src/DisplayType/LegacyTemplateLocator.php#L140
• https://plugins.trac.wordpress.org/changeset/3460327/nextgen-gallery/trunk/src/DisplayType/LegacyTemplateLocator.php?old=3423202&old_path=nextgen-gallery%2Ftrunk%2Fsrc%2FDisplayType%2FLegacyTemplateLocator.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2d7bc556-cdaf-42a7-8801-ad2e4945a137?source=cve

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 18, 2026

🟠 CVE-2026-1463 - High (8.8) The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.3 via the 'template' parameter in gallery shortcodes. This makes it possible f... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1463/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner