The NextGEN Gallery plugin (by Smub) is vulnerable to an insecure direct object reference in all releases up to and including 4.2.0. The vulnerability arises because the permission callback for the REST endpoint DELETE /imagely/v1/images/{id} only verifies that a user has the 'NextGEN Manage gallery' capability, but it does not check that the gallery belongs to the authenticated user or that the user has the higher 'NextGEN Manage others gallery' privilege. Consequently, attackers who can log in with a Subscriber+ role and possess the basic gallery management capability can delete images created by other users, and, when the deleteImg feature is enabled (it is enabled by default), the associated image files are also removed from the server’s file system.

All installations of the WordPress plugin NextGEN Gallery that are running version 4.2.0 or earlier are affected. The plugin is distributed by Smub and is commonly bundled as a photo gallery, slider, proofing, and theme solution for WordPress sites. No specific minor version increments within the 4.2.0 release series were noted to be safe, so every build up to and including that release remains vulnerable.

The vulnerability has a CVSS score of 4.3, categorizing it as moderate. Because the attacker must be authenticated and must have been granted the gallery management capability, the exploit window is narrower than with publicly exploitable flaws. The EPSS score is not available, and the CVE is not listed in CISA’s KEV catalog, suggesting no widespread active exploitation. The attack vector is likely remote via the REST API, and it does not provide code execution or privilege escalation beyond the existing role. The impact is loss of gallery content and potential disruption of site media assets.