# CVE-2026-81650: NextGEN Gallery arbitrary file upload via ZIP import

Source: https://junglewise.ai/threats/cve-2026-81650-the-photo-gallery-sliders-proofing-and-wordpress-plugin-before-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-20. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-81650 · Severity: high · CVSS 7.2 · Published 2026-09-20

NextGEN Gallery is a WordPress plugin that manages photo galleries on websites. A flaw in the file extraction process allows users with gallery-management privileges to upload malicious files disguised in ZIP archives, potentially executing arbitrary code on the web server.

Technologies: [Imagely NextGEN Gallery](https://junglewise.ai/threats/technologies/nextgen-gallery). Vendors: [Imagely](https://junglewise.ai/threats/vendors/imagely).

## Quick answers

**Is CVE-2026-81650 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81650 being exploited in the wild.

**How severe is CVE-2026-81650?** High severity, with a CVSS score of 7.2, published 20 September 2026.

**Which products and versions are affected?** Imagely NextGEN Gallery before 4.5.0.

**Is there a fix for CVE-2026-81650?** A patch was published on 2026-09-20: version 4.5.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81650 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-81650?** Check whether you run Imagely NextGEN Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to validate file extensions during ZIP archive extraction due to a loop counter variable reuse, causing the extension check to always pass. An authenticated attacker with gallery-management capability can exploit this to write arbitrary files to web-accessible directories. On servers configured to execute the uploaded files, this enables remote code execution.

## Affected products

- Imagely NextGEN Gallery before 4.5.0

## Timeline

- 2026-09-18: disclosed
- 2026-09-20: patched: version 4.5.0 released

## References

- [https://wpscan.com/vulnerability/7c1443ae-14b4-43ca-bb1a-b6a3f9b27c57/](https://wpscan.com/vulnerability/7c1443ae-14b4-43ca-bb1a-b6a3f9b27c57/)

## Related threats

- [NextGEN Gallery remote code execution in legacy_render](https://junglewise.ai/threats/cve-2026-76012-the-photo-gallery-sliders-proofing-and-themes-nextgen-gallery)
- [Imagely NextGEN Gallery SQL injection in REST API](https://junglewise.ai/threats/cve-2026-9059-imagely-nextgen-gallery-sql-injection-in-rest-api)
- [Imagely NextGEN Gallery IDOR in image deletion REST flow](https://junglewise.ai/threats/cve-2026-6566-imagely-nextgen-gallery-idor-in-image-deletion-rest-flow)