Security Alert Summary
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress contains a Local File Inclusion (LFI) vulnerability via the template shortcode parameter. Insufficient path validation allows absolute paths to be provided, which can enable authenticated users with Contributor-level access or higher to include and execute PHP files on the server, potentially leading to information disclosure and code execution in the WordPress context.
CVE Details
- CVE ID: CVE-2025-13641
- Affected component: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress
- Affected versions: All versions up to, and including, 3.59.12
- Published: December 18, 2025 at 10:16:10 AM
- Last modified: December 18, 2025 at 3:07:18 PM
- CVSS v3.1 Base Score: 8.8 (HIGH) —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Authentication / Privileges / User Interaction: Authenticated attacker required; Contributor-level access and above (CVSS Privileges Required: Low); User Interaction: None
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE / Weakness: CWE-22 (Path Traversal)
Technical Details
The vulnerability is a Local File Inclusion (LFI) caused by insufficient path validation on the template shortcode parameter. The plugin accepts an absolute path from that parameter, allowing an authenticated user with sufficient privileges to specify server-side file paths. When an absolute path to a PHP file is provided and included by the plugin, the PHP code in that file may be executed in the WordPress context, bypassing web server restrictions such as .htaccess.
Because the issue allows inclusion of arbitrary files via a user-controllable parameter, successful exploitation can result in information disclosure (reading files), execution of PHP code within WordPress, and—if combined with separate functionality that permits arbitrary file upload—potential remote code execution. The behavior stems from missing or insufficient path validation checks on the provided template value.
How This Could Impact Your Website
In a typical site scenario, a site owner manages plugin installations while internal staff and external contributors publish or edit content. An authenticated contributor (or higher) who can add or modify shortcodes could supply a crafted template parameter that points to an absolute path on the server. That may allow an attacker to include sensitive files (for example, configuration files) or execute PHP present on the filesystem.
Practical consequences include exposure of internal data (database credentials or user details), modification of site content or settings through executed code, and increased risk of targeted phishing if internal email addresses or user lists are disclosed. The threat is higher on sites where multiple users have contributor-level access or where untrusted third parties can edit shortcodes.
professional review may be worth considering if you’re unsure whether your site is affected or how to assess your current user roles and plugins.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE notes affected versions up to and including 3.59.12; a fixed version is not specified in the CVE entry.)
- Review and reduce unnecessary user roles, especially contributors and other roles that can add or edit content or shortcodes.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior, including unexpected file inclusions or changes to template-related functionality.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/nextgen-gallery/trunk/src/DisplayType/Controller.php#L369
- https://plugins.trac.wordpress.org/browser/nextgen-gallery/trunk/src/DisplayType/LegacyTemplateLocator.php#L152
- https://plugins.trac.wordpress.org/changeset/3415575/nextgen-gallery/trunk/src/DisplayType/LegacyTemplateLocator.php?old=3004370&old_path=nextgen-gallery%2Ftrunk%2Fsrc%2FDisplayType%2FLegacyTemplateLocator.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0a01e1c9-67f4-4cc1-b58b-9cc141889d66?source=cve
