title: NextGEN Gallery < 3.39 - Admin+ Local File Inclusion
description: The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
vendor: Unknown
product: WordPress Gallery Plugin
versions:
status: affected, versionType: custom, version: 0, lessThan: 3.39
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}