CVE-2026-6566

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6566", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-04-18T17:51:56.808Z", "datePublished": "2026-05-20T05:31:10.536Z", "dateUpdated": "2026-05-20T15:54:05.752Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-05-20T05:31:10.536Z"}, "affected": [{"vendor": "smub", "product": "Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. This is due to insufficient object-level authorization in the image deletion REST flow where the permission callback for DELETE /imagely/v1/images/{id} only checks 'NextGEN Manage gallery' permissions and does not enforce gallery ownership or 'NextGEN Manage others gallery' permissions. This makes it possible for authenticated attackers, with Subscriber-level privileges and 'NextGEN Manage gallery' capability, to delete gallery images belonging to other users as well as their associated image files from disk when deleteImg is enabled (default)."}], "title": "Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/439809ad-21ea-4a0b-b1fd-5de9f8f5ee7a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3533432/nextgen-gallery"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Bao Luu Gia Nguyen"}], "timeline": [{"time": "2026-04-18T20:42:58.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-05-19T17:01:55.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-20T15:43:36.099126Z", "id": "CVE-2026-6566", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T15:54:05.752Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6566", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-20T15:43:36.099126Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T15:49:22.659Z"}}], "cna": {"title": "Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API", "credits": [{"lang": "en", "type": "finder", "value": "Bao Luu Gia Nguyen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "smub", "product": "Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.2.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-18T20:42:58.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-05-19T17:01:55.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/439809ad-21ea-4a0b-b1fd-5de9f8f5ee7a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3533432/nextgen-gallery"}], "descriptions": [{"lang": "en", "value": "The Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. This is due to insufficient object-level authorization in the image deletion REST flow where the permission callback for DELETE /imagely/v1/images/{id} only checks 'NextGEN Manage gallery' permissions and does not enforce gallery ownership or 'NextGEN Manage others gallery' permissions. This makes it possible for authenticated attackers, with Subscriber-level privileges and 'NextGEN Manage gallery' capability, to delete gallery images belonging to other users as well as their associated image files from disk when deleteImg is enabled (default)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-05-20T05:31:10.536Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6566", "state": "PUBLISHED", "dateUpdated": "2026-05-20T15:54:05.752Z", "dateReserved": "2026-04-18T17:51:56.808Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-05-20T05:31:10.536Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery", "vendor": "smub", "versions": [{"lessThanOrEqual": "4.2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. This is due to insufficient object-level authorization in the image deletion REST flow where the permission callback for DELETE /imagely/v1/images/{id} only checks 'NextGEN Manage gallery' permissions and does not enforce gallery ownership or 'NextGEN Manage others gallery' permissions. This makes it possible for authenticated attackers, with Subscriber-level privileges and 'NextGEN Manage gallery' capability, to delete gallery images belonging to other users as well as their associated image files from disk when deleteImg is enabled (default)."}, {"lang": "es", "value": "El plugin Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery para WordPress es vulnerable a Referencia Directa Insegura a Objeto en versiones hasta la 4.2.0 inclusive. Esto se debe a una autorizaci\u00f3n a nivel de objeto insuficiente en el flujo REST de eliminaci\u00f3n de im\u00e1genes, donde la funci\u00f3n de devoluci\u00f3n de llamada de permisos para DELETE /imagely/v1/images/{id} solo verifica los permisos 'NextGEN Manage gallery' y no impone la propiedad de la galer\u00eda o los permisos 'NextGEN Manage others gallery'. Esto hace posible que atacantes autenticados, con privilegios de nivel de Suscriptor y la capacidad 'NextGEN Manage gallery', eliminen im\u00e1genes de la galer\u00eda pertenecientes a otros usuarios, as\u00ed como sus archivos de imagen asociados del disco cuando deleteImg est\u00e1 habilitado (por defecto)."}], "id": "CVE-2026-6566", "lastModified": "2026-07-24T08:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6566", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-20T15:43:36.099126Z", "version": "2.0.3"}}]}, "published": "2026-05-20T07:16:16.030", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3533432/nextgen-gallery"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/439809ad-21ea-4a0b-b1fd-5de9f8f5ee7a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.2.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery", "source": "cna", "vendor": "smub"}, "product": "photo_gallery,_sliders,_proofing_and_themes_\u2013_nextgen_gallery", "vendor": "smub"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "created": "2026-05-20T07:30:25.076244+00:00", "updated": "2026-05-20T07:30:25.323098+00:00", "vendors": ["smub", "smub$PRODUCT$photo_gallery,_sliders,_proofing_and_themes_\u2013_nextgen_gallery", "wordpress", "wordpress$PRODUCT$wordpress"]}