Threats tagged 'ghsa-3x55-4c6j-rgh3'

The NextGEN Gallery plugin for WordPress versions up to and including 4.4.1 contains a remote code execution vulnerability via the render_image function. This flaw arises from unrestricted mass assignment of user-supplied meta_data keys to the image model, combined with missing realpath containment and a bypassable signature check on the public image delivery route. Authenticated attackers with custom-level access or higher who own at least one NextGEN gallery can exploit this to execute code on the server. Notably, the condition to own a gallery can be met by any Subscriber previously granted the 'NextGEN Manage gallery' capability, which persists indefinitely even after revocation.