Threats tagged 'ghsa-5hr5-5vc8-hvg6'

The NextGEN Gallery plugin for WordPress up to version 4.4.1 contains a remote code execution vulnerability via the legacy_render function. This flaw arises from broken authorization on the Lightroom gallery_edit endpoint, allowing authenticated users with custom-level access or higher who own at least one gallery to upload files with crafted extensions that bypass checks. This enables execution of arbitrary code on the server.