A flaw in the NextGEN Gallery WordPress plugin allows an authenticated user with Contributor or higher privileges to supply an absolute file path to the 'template' shortcode parameter. Because the plugin lacks proper path validation, the attacker can cause the server to include arbitrary PHP files, potentially executing malicious code in the WordPress context. The vulnerability may also enable the disclosure of sensitive data and, when combined with an arbitrary file upload capability, could result in remote code execution.

The vulnerability impacts the NextGEN Gallery plugin for WordPress sold by smub under the name Songoda Audio "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery." All plugin releases up to and including version 3.59.12 are affected. Users running these versions should verify that they are not running the compromised code base.

The CVSS score of 8.8 classifies the flaw as critical, and the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild so far. The attacker must be authenticated and possess at least Contributor role privileges to exploit the flaw, which limits the attack surface to users already able to post content. The vulnerability is not listed in the CISA KEV catalog, but the potential for local file inclusion leading to PHP execution warrants prioritizing a patch when available.