CVE-2020-35943

The NextGEN Gallery plugin before version 3.5.0 contained a security flaw in its "validate_ajax_request" function that could be circumvented by submitting requests that omitted the nonce parameter, thereby bypassing intended access controls. An attacker could exploit this weakness to upload files containing arbitrary code disguised as images, and if such a file were subsequently included through the vulnerability described in CVE-2020-35942, the embedded PHP code would be executed on the server.

Based on public CVE data (MITRE/NVD).