The vulnerability is a Remote Code Execution flaw that allows an attacker to craft a request to the Lightroom 'gallery_edit' endpoint. Because the plugin fails to enforce proper authorization, an attacker with a custom or higher level who is the registered author of at least one gallery can supply a gallery path and an uploaded file. The mass‑assignment and lack of proper extension validation permit the upload of files with a hidden .php suffix. The server then saves the file in the gallery's template directory and loads it as a PHP template, causing the code to be executed with the web server’s privileges.

The flaw exists in all releases of the NextGEN Gallery WordPress plugin up to and including 4.4.1. The plugin is known as Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery. WordPress sites that use any of these versions and have users with custom‑level or higher access who own a gallery are potentially vulnerable. Administrators should review the installed version and the user roles.

The CVSS score of 7.5 indicates a high severity. No EPSS score is available, but the lack of check in the KEV catalog suggests that it has not yet been widely exploited. The vulnerability can be triggered remotely over HTTP by an authenticated user, which makes it practical for an attacker who can compromise or guess a user account with gallery ownership. In the absence of a recent exploitation phenomenon, the priority for remediation is still high due to the high impact of remote code execution.