createNewThumb and rotateImage AJAX actions, which makes it possible for attackers to make logged in users with the nextgen_edit_gallery capability to modify the images via a forged request if they can trick an administrator into performing an action such as clicking on a link. 