NextGEN Gallery Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress, affecting all versions through 4.0.3. The vulnerability arises from the 'template' parameter in gallery shortcodes, allowing authenticated attackers with Author-level access and above to include and execute arbitrary PHP files on the server. This exploitation could bypass access controls, access sensitive data, or execute code in cases where PHP files can be uploaded and included.

Impact

Exploitation of this vulnerability could lead to unauthorized file inclusion, allowing attackers to execute arbitrary PHP code on the server.

Reproduction

To reproduce this vulnerability, an authenticated user with Author-level access or higher can create a gallery shortcode that includes a 'template' parameter. The parameter can be manipulated to include arbitrary PHP files from the server, exploiting the local file inclusion vulnerability.

Remediation

Users are advised to update the NextGEN Gallery plugin to version 4.0.5 or later.