CVE-2026-9059
NextGEN Gallery versions before 4.2.1 are vulnerable to a critical SQL injection attack that can be triggered by an authenticated user with the 'NextGEN Gallery overview' capability. The flaw lies in the 'orderby' parameter of the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums', which fails to properly sanitize input. An attacker could inject arbitrary SQL into the ORDER BY clause, potentially compromising the database.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
WordPress sites using the NextGEN Gallery plugin, specifically versions earlier than 4.2.1.
Real-world impact
An attacker could run arbitrary SQL commands against the WordPress database, leading to data theft, modification, or deletion, and potentially taking control of the site.
Why this severity
The CVSS score of 9.3 reflects the high impact of the vulnerability: it requires authentication but offers high privileges, allows arbitrary SQL injection, and can lead to complete compromise of the database.
What to do about it
- 01Upgrade NextGEN Gallery to version 4.2.1 or later.
- 02Restart WordPress or the web server to apply the update.
- 03Verify that the REST API endpoints no longer accept malicious 'orderby' values.
- ›Restrict access to the REST API endpoints to trusted users only.
- ›Remove or limit the 'NextGEN Gallery overview' capability for non-admin users.
- ›Disable the 'orderby' parameter if possible.
NVD description
Timeline
- May 20, 2026 · May 20, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.