CVE-2026-1463: 
WordPress vulnerability analysis and mitigation

CVE-2026-1463 is a Local File Inclusion (LFI) vulnerability in the NextGEN Gallery plugin for WordPress ("Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery"), affecting all versions up to and including 4.0.3. The flaw allows authenticated attackers with Author-level access or higher to include and execute arbitrary PHP files on the server via the template parameter in gallery shortcodes. It was published on March 18, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 8.8 (High) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program, also known as PHP Remote File Inclusion/Local File Inclusion). The vulnerability exists in the LegacyTemplateLocator.php (line 140) and Controller.php (line 369) source files of the plugin, where the template parameter passed via gallery shortcodes is not properly sanitized before being used in a PHP file include statement. An attacker with Author-level WordPress access can craft a malicious shortcode with a manipulated template value pointing to an attacker-controlled PHP file already present on the server, triggering its execution (Wordfence, WordPress Trac - LegacyTemplateLocator, WordPress Trac - Controller).

Successful exploitation allows an authenticated attacker to execute arbitrary PHP code on the server, leading to full compromise of confidentiality, integrity, and availability. Attackers can bypass access controls, exfiltrate sensitive data (including WordPress database credentials and user data), install backdoors or web shells, and potentially pivot to other systems on the same hosting environment. The impact is particularly severe in environments where PHP file uploads are permitted, as attackers can upload and then execute malicious files (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been confirmed as of the available data. The EPSS score is approximately 0.087%, indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It has been detected by Qualys (detection ID 531113) and is tracked in multiple vulnerability databases (Wordfence, Qualys).

1. Reconnaissance: Identify WordPress sites running NextGEN Gallery plugin version 4.0.3 or earlier using tools like WPScan or by inspecting page source for plugin version indicators.
2. Obtain Author-level access: Register or compromise an account with at least Author-level privileges on the target WordPress site (e.g., via credential stuffing, phishing, or exploiting a separate registration vulnerability).
3. Upload a malicious PHP file: If file uploads are permitted for the attacker's role, upload a PHP web shell or malicious script to the server (e.g., via the WordPress media library or NextGEN Gallery's own upload functionality).
4. Craft a malicious shortcode: Create or edit a post/page with a NextGEN Gallery shortcode that sets the template parameter to the path of the uploaded malicious PHP file, e.g., [ngg src="galleries" ids="1" display="basic_thumbnail" template="../../uploads/malicious.php"].
5. Trigger execution: Publish or preview the post/page to cause the server to include and execute the malicious PHP file, achieving remote code execution.
6. Post-exploitation: Use the web shell to exfiltrate data, establish persistence, or move laterally within the hosting environment (Wordfence, WordPress Trac - LegacyTemplateLocator).

• Logs: WordPress access logs showing POST or GET requests to pages/posts containing NextGEN Gallery shortcodes with unusual template parameter values (e.g., path traversal sequences like ../../); PHP error logs referencing unexpected file inclusion paths within the NextGEN Gallery plugin context.
• File System: Presence of unexpected .php files in the WordPress uploads directory or other writable directories; newly created web shells or scripts not associated with legitimate plugin or theme files.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) following requests to pages with NextGEN Gallery shortcodes.
• Network: Outbound connections from the web server to unknown external IPs or domains following suspicious shortcode rendering requests.

Users should update the NextGEN Gallery plugin to version 4.0.4 or later, which contains the patch addressing this vulnerability (WordPress Trac - Changeset). As a temporary workaround where immediate patching is not possible, restrict Author-level and above user accounts to trusted individuals only, and disable PHP file uploads on the server. Web application firewalls (WAFs) such as Wordfence can provide virtual patching to block exploitation attempts while a patch is applied (Wordfence).

Wordfence disclosed the vulnerability and included it in their weekly WordPress vulnerability report for March 16–22, 2026 (Wordfence Blog). Sucuri also referenced the vulnerability in their March 2026 vulnerability patch roundup (Sucuri Blog). Social media accounts such as RedPacketSecurity shared the CVE details on Mastodon and Twitter/X shortly after disclosure, contributing to broader community awareness.