# CVE-2026-76012: NextGEN Gallery remote code execution in legacy_render

Source: https://junglewise.ai/threats/cve-2026-76012-the-photo-gallery-sliders-proofing-and-themes-nextgen-gallery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-76012 · Severity: high · CVSS 7.5 · Published 2026-10-30

NextGEN Gallery is a WordPress plugin for managing photo galleries. Authenticated users with custom-level access or higher can upload specially crafted files that bypass extension validation, allowing them to execute arbitrary code on the web server. An attacker must own at least one gallery in the plugin, but can then achieve full server compromise.

Technologies: [Imagely NextGEN Gallery](https://junglewise.ai/threats/technologies/nextgen-gallery). Vendors: [Imagely](https://junglewise.ai/threats/vendors/imagely).

## Quick answers

**Is CVE-2026-76012 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76012 being exploited in the wild.

**How severe is CVE-2026-76012?** High severity, with a CVSS score of 7.5, published 30 October 2026.

**Which products and versions are affected?** Imagely NextGEN Gallery up to and including 4.4.1.

**Is there a fix for CVE-2026-76012?** Yes: fixed in <UNKNOWN>. Until then: <UNKNOWN> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76012 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-76012?** Check whether you run Imagely NextGEN Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in <UNKNOWN>

<UNKNOWN>

## Technical details

The vulnerability combines broken authorization on the gallery_edit endpoint with mass assignment of the gallery path parameter and unrestricted file upload to a template directory. The extension validation uses substring matching that accepts .php_ filenames as valid templates, bypassing security controls. An authenticated user with gallery ownership can exploit this chain to upload and execute PHP code.

## Affected products

- Imagely NextGEN Gallery up to and including 4.4.1

## Timeline

- 2026-10-30: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DisplayType/Controller.php](https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DisplayType/Controller.php)
- [https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DisplayType/LegacyTemplateLocator.php](https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DisplayType/LegacyTemplateLocator.php)

## Related threats

- [NextGEN Gallery arbitrary file upload via ZIP import](https://junglewise.ai/threats/cve-2026-81650-the-photo-gallery-sliders-proofing-and-wordpress-plugin-before-4)
- [Imagely NextGEN Gallery SQL injection in REST API](https://junglewise.ai/threats/cve-2026-9059-imagely-nextgen-gallery-sql-injection-in-rest-api)
- [Imagely NextGEN Gallery IDOR in image deletion REST flow](https://junglewise.ai/threats/cve-2026-6566-imagely-nextgen-gallery-idor-in-image-deletion-rest-flow)