The NextGEN Gallery plugin for WordPress is prone to a path-disclosure vulnerability. An attacker can exploit this issue to obtain sensitive information that may lead to further attacks. The vulnerability is triggered when an attacker sends a specially crafted request to the vulnerable application. This can be done by sending a request to the vulnerable application with the following parameters: http://www.example.com/?callback=json&api_key=true&format=json&method=gallery&id=1 and http://www.example.com/?callback=json&api_key=true&format=xml&method=recent&limit=1