CVE-2026-6566

The NextGEN Gallery plugin for WordPress contains a flaw in its REST API handling of image deletions. Specifically, the permission check for deleting images only verifies that a user has 'NextGEN Manage gallery' permissions, but does not ensure they own the affected gallery or have permission to manage others'. This oversight allows authorized users with Subscriber-level access and 'NextGEN Manage gallery' capability to delete images from other galleries and remove associated files from disk.

Based on public CVE data (MITRE/NVD).