Description
WordPress Plugin NextGEN Gallery-WordPress Gallery is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin NextGEN Gallery-WordPress Gallery version 2.1.7 is vulnerable; prior versions are also affected.
Remediation
Update to plugin version 2.1.9 or latest
References
Related Vulnerabilities
WordPress 'templates.php' Cross-Site Scripting Vulnerability (0.6.2 - 2.1)
Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-1999006)
WordPress Inadequate Encryption Strength Vulnerability (CVE-2012-6707)
WordPress Plugin Link Log-external link click monitor SQL Injection (2.0)