CVE-2026-81652

COMPONENT VERSION RANGE

NewScan fingerprints nextgen-gallery from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-09-20 (/daily-cve). ONE row for both ids because 4.5.0 fixes both - two rows would be two findings that say the same `upgrade to 4.5.0`, the Adminer/Bouncy Castle precedent. CVE-2026-81652 is the head: the plugin returns a requested image record without checking the caller is entitled to it, so a subscriber-level account reads images from galleries it was never given - including client proofing galleries, which is this plugin's paid use and therefore the confidentiality the customer bought. CVE-2026-81654 is the same missing-check shape on the write side: no options-capability check before saving image sizing settings. SLUG VERIFIED, NOT INFERRED: api.wordpress.org/plugins/info/1.0/nextgen-gallery.json answers 'Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery' at 4.5.1, which both confirms the directory name the readme join needs AND independently confirms 4.5.0 is a published release rather than an advisory's guess. Version source is the standard WordPress component route scan_wordpress already walks and needs no code: the plugin enqueues its assets as /wp-content/plugins/nextgen-gallery/<...>?ver=<plugin version>, which wordpress_tools.find_plugins keys by the directory slug `nextgen-gallery` (this row's key), refined where present by the plugin's readme.txt `Stable tag:`. High rather than critical: both ids need a login, low-privileged but not anonymous. Version-match only - confirming the read means pulling another customer's proofs off a stranger's site, and confirming the write means changing their gallery settings.