An authenticated attacker with custom-level access can achieve remote code execution in the NextGEN Gallery plugin for WordPress. This is due to unrestricted…
Affected component: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery (plugin)
Fixed in: 4.5.0
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since November 1, 2026. No PowerSEC firewall rule blocks this attack. Update to 4.5.0 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-76010