A critical local file inclusion vulnerability in the NextGEN Gallery WordPress plugin allows authenticated attackers with Author-level privileges to achieve remote code execution.

This vulnerability is a Local File Inclusion flaw (CWE-98) located within the template parameter of gallery shortcodes. It requires the attacker to possess at least Author-level authentication to trigger the inclusion and execution of arbitrary PHP files on the host server.

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary code, which can lead to a full compromise of the WordPress environment. Given the CVSS score of 8.8, this represents a high-severity risk that could result in unauthorized data access, modification of site content, or complete system takeover. The ability to execute arbitrary PHP code effectively bypasses standard application-level access controls.

Immediate Action: Update the NextGEN Gallery plugin to the latest available version beyond 4.0.4, as specified by the vendor advisory.

Proactive Monitoring: Monitor server logs for suspicious requests involving the template parameter or unexpected file inclusion attempts that target sensitive system directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing directory traversal patterns or unusual file paths within plugin-specific parameters.

Public Exploit Available: No

The severity of this vulnerability necessitates immediate attention to prevent potential remote code execution. Administrators should prioritize updating the NextGEN Gallery plugin and auditing the permissions of all accounts with Author-level access or higher to reduce the attack surface. Failure to patch may expose the underlying server to unauthorized access and severe data integrity risks.