CVE-2026-73185: NGG Smart Image Search SQLi Vulnerability

CVE-2026-73185 Overview

CVE-2026-73185 is an unauthenticated SQL injection vulnerability in the NGG Smart Image Search WordPress plugin. The flaw affects all versions prior to 4.0.0. Attackers can send crafted requests over the network without authentication or user interaction. The issue is tracked under CWE-89, which covers improper neutralization of special elements used in an SQL command.

The vulnerability carries a scope-changing impact, meaning exploitation can affect resources beyond the vulnerable component. Successful attacks can expose database contents and disrupt plugin availability on affected WordPress sites.

Critical Impact
Remote attackers can inject arbitrary SQL statements against WordPress sites running NGG Smart Image Search prior to 4.0.0 without any authentication.

Affected Products

NGG Smart Image Search WordPress plugin versions prior to 4.0.0
WordPress installations with the NGG Smart Image Search plugin enabled
Sites relying on the NextGEN Gallery search integration provided by this plugin

Discovery Timeline

2026-08-19 - CVE-2026-73185 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73185

Vulnerability Analysis

The vulnerability allows unauthenticated SQL injection in NGG Smart Image Search versions prior to 4.0.0. Attackers can submit malicious input through a search parameter that the plugin passes into a database query without proper sanitization. The result is arbitrary SQL execution against the WordPress database.

The CVSS vector indicates a scope change, so injected SQL can reach data beyond the plugin's own tables. Attackers commonly leverage this class of flaw to enumerate the wp_users and wp_options tables, extract password hashes, and exfiltrate site secrets. The EPSS data at publication estimates a low near-term exploitation probability, but the low complexity of the attack means opportunistic scanning is likely.

Root Cause

The root cause is improper neutralization of user-supplied input in SQL queries [CWE-89]. The plugin builds queries by concatenating request parameters into SQL strings rather than using parameterized statements or the WordPress $wpdb->prepare() API. This allows attacker-controlled input to alter query structure.

Attack Vector

Exploitation occurs over the network against the plugin's public search endpoints. No authentication or user interaction is required. An attacker sends a specially crafted HTTP request containing SQL metacharacters within the search parameter. The injected payload is executed by the database engine, returning attacker-selected data or triggering time-based blind extraction. Refer to the Patchstack SQL Injection Advisory for advisory-level technical detail.

Detection Methods for CVE-2026-73185

Indicators of Compromise

HTTP requests to NGG Smart Image Search endpoints containing SQL metacharacters such as UNION SELECT, SLEEP(, information_schema, or --
Unexpected outbound queries or high-volume responses from /wp-admin/admin-ajax.php tied to the plugin's action handlers
Database logs showing malformed queries referencing wp_users, user_pass, or wp_options
New or modified administrator accounts in WordPress following anomalous search traffic

Detection Strategies

Inspect web server access logs for search parameters containing SQL syntax, encoded quotes, or boolean-based payloads like ' OR 1=1--
Deploy WAF rules that flag SQL injection patterns targeting NGG Smart Image Search AJAX actions
Correlate spikes in 500-level responses or long request durations against the plugin with SQL error patterns in MySQL logs

Monitoring Recommendations

Enable MySQL general query logging on staging or forensic captures to identify injected UNION or SLEEP patterns
Alert on creation of WordPress users with the administrator role outside change-management windows
Monitor file integrity of the wp-content/plugins/ngg-smart-image-search/ directory for tampering

How to Mitigate CVE-2026-73185

Immediate Actions Required

Update NGG Smart Image Search to version 4.0.0 or later on all WordPress instances
Audit WordPress user accounts, application passwords, and secrets stored in wp_options for signs of exfiltration
Rotate database credentials and WordPress salts if exploitation is suspected

Patch Information

The vendor addresses this issue in NGG Smart Image Search 4.0.0. Administrators should apply the update through the WordPress plugin manager or by installing the patched release directly. Details are available in the Patchstack SQL Injection Advisory.

Workarounds

Disable and remove the NGG Smart Image Search plugin until the patched version is deployed
Restrict access to the plugin's AJAX endpoints using WAF rules or HTTP authentication
Deploy virtual patching via a WAF to block SQL injection payloads targeting the plugin's search parameters

bash

# Configuration example: WP-CLI commands to update or deactivate the vulnerable plugin
wp plugin update ngg-smart-image-search --version=4.0.0
# If updating is not immediately possible, deactivate the plugin
wp plugin deactivate ngg-smart-image-search