CVE-2025-13641 is a Local File Inclusion vulnerability in the NextGEN Gallery WordPress plugin, affecting all versions up to 3.59.12. The issue arises from insufficient validation of the 'template' shortcode parameter, which accepts absolute paths, enabling authenticated attackers with Contributor-level privileges or higher to include arbitrary PHP files. This can bypass web server restrictions like .htaccess, potentially leading to information disclosure and code execution within the WordPress environment. The vulnerability has a CVSS 3.1 score of 8.8 (high severity), indicating network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No known exploits in the wild or patches are currently documented.

Successful exploitation allows authenticated users with Contributor or higher privileges to execute arbitrary PHP code on the server by including files via the vulnerable 'template' parameter. This can lead to information disclosure, code execution in the context of the WordPress application, and potentially full remote code execution if combined with other vulnerabilities such as arbitrary file upload. The impact affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Monitor for updates from the plugin vendor or WordPress security channels for patches or official mitigations. Avoid using the vulnerable versions of the NextGEN Gallery plugin if possible.