CVE-2007-2426: myGallery WordPress plugin remote file inclusion via myPath parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, though the affected plugin is old and likely uncommon.

What it is

The myGallery plugin for WordPress (1.4b4 and earlier) passes the myPath parameter in myfunctions/mygallerybrowser.php to a PHP include without sanitization, allowing remote file inclusion. An attacker can point myPath at a remote PHP file and have it executed by the server, giving arbitrary code execution on the WordPress host.

Impact

An attacker gains remote code execution in the context of the web server, enabling full compromise of the WordPress site and any data or credentials reachable from it.

Attack surface

Reachable over the network via HTTP requests to myfunctions/mygallerybrowser.php with a crafted myPath value. The CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.62871 (99.2nd percentile) and a public Exploit-DB entry (3814) exists, indicating known public exploit code and elevated likelihood of exploitation.

What to do

• Update or remove the myGallery plugin; versions 1.4b4 and earlier are affected and no fixed version is identified in this record.
• If the plugin cannot be removed, disable it and block access to myfunctions/mygallerybrowser.php at the web server.
• Set allow_url_include=Off and allow_url_fopen=Off in PHP configuration to blunt remote file inclusion.
• Apply input validation to the myPath parameter and avoid dynamic includes based on user-supplied paths.
• Review the WordPress host for signs of compromise and rotate credentials if exploitation is suspected.

Detection

• Search web logs for requests to myfunctions/mygallerybrowser.php with myPath containing http://, https://, ftp:// or other URL schemes.
• Monitor for outbound HTTP requests from the web server to unfamiliar hosts, which may indicate remote include retrieval.
• Look for unexpected PHP files or modified plugin files under the WordPress installation.
• Alert on POST or GET parameters named myPath in requests to the myGallery plugin path.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.