Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'

I cannot fulfill the request to produce a detailed exploitation research plan or provide actionable payloads for this vulnerability. My safety guidelines prohibit the generation of functional exploit material or step-by-step guides for exploiting high-severity vulnerabilities.

However, I can provide a technical analysis of the vulnerability mechanics and discuss the defensive principles relevant to Local File Inclusion (LFI) in WordPress plugins.

Technical Analysis: CVE-2025-13641

The vulnerability in NextGEN Gallery (<= 3.59.12) is a Local File Inclusion (LFI) issue residing in the handling of the template attribute within the plugin's shortcode functionality.

1. Vulnerability Mechanism

The core of the issue is insufficient path validation. When a plugin allows a user-defined template, it must ensure that the input is restricted to a specific, safe directory.

In this case, the template parameter in the [ngg] shortcode (and potentially others) is used to determine which PHP file should be included to render the gallery output. If the plugin implementation uses the provided string directly in an include() or require() statement without stripping directory information or validating that the path is relative and safe, it becomes vulnerable.

The CVE description specifically highlights that absolute paths are accepted. This suggests that the code might check for file existence using the user-provided path directly, rather than prepending a mandatory plugin-controlled directory prefix.

2. Code Flow (Theoretical)

1. Entry Point: An authenticated user with at least Contributor-level permissions creates or edits a post/page and inserts a shortcode, such as [ngg template="/absolute/path/to/sensitive/file"].
2. Trigger: The user previews the post. WordPress's do_shortcode() function parses the attributes and invokes the registered handler for the ngg shortcode.
3. Processing: The shortcode handler extracts the template attribute.
4. The Sink: The value is passed to a rendering method within the NextGEN Gallery framework (often involving its internal "Pope" engine). This method eventually executes a PHP file inclusion function (include, require, include_once, etc.).
5. Execution: Because the path is absolute and unvalidated, the PHP interpreter attempts to load the file from the specified location on the server's filesystem.

3. Authentication and Impact

While the vulnerability requires Contributor-level access, this is a significant risk because Contributors are standard users who can normally only create drafts. The ability to use shortcodes allows them to leverage the server's local file access permissions.

• Information Disclosure: Attackers can read sensitive files like wp-config.php, which contains database credentials and WordPress security salts.
• Context Bypass: This inclusion happens within the WordPress execution context, meaning even files protected by .htaccess (which restricts external HTTP access) can be read or executed if they contain PHP.
• Potential RCE: If an attacker can upload a file (e.g., a "poisoned" image containing PHP code) through other means, they can use this LFI to execute that code.

Defensive Remediation

To prevent LFI vulnerabilities when handling file paths from user-controlled input, developers should implement the following strategies:

1. Enforce Base Names: Use basename() to strip all directory information from the input, ensuring only a filename can be provided.

   $template = basename( $atts['template'] );
   

2. Whitelist Validation: Only allow a predefined list of template names.
3. Strict Path Verification: If dynamic pathing is necessary, resolve the path using realpath() and verify that the resulting absolute path begins with the intended directory.

   $base_dir = plugin_dir_path( __FILE__ ) . 'templates/';
   $requested_path = realpath( $base_dir . $atts['template'] . '.php' );
   
   // Ensure the resolved path is within the base directory
   if ( $requested_path && strpos( $requested_path, $base_dir ) === 0 ) {
       include( $requested_path );
   }
   

4. Use Built-in Sanitization: WordPress provides sanitize_file_name(), which should be used to remove potentially dangerous characters (like .., /, and \) from the input string.

For site administrators, the primary defense is to update the NextGEN Gallery plugin to version 4.0.0 or later, where these path validation checks have been implemented.