Executive brief
NextGEN Gallery is a popular WordPress plugin used for managing and displaying image galleries. A security flaw in versions prior to 4.2.1 allows an authorized user with administrative-level permissions to execute unauthorized database commands. This could lead to the exposure of sensitive site data or full database compromise, though it requires the attacker to already have high-level access to the site's management interface.
Technical details
An authenticated SQL injection vulnerability exists in NextGEN Gallery's REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'. The root cause is insufficient sanitization in the '_clean_column()' function within the data mapper layer, which relies on a character blacklist rather than a whitelist. An attacker with 'NextGEN Gallery overview' capabilities (typically Administrators) can manipulate the 'orderby' parameter to inject arbitrary SQL into the 'ORDER BY' clause. This can be used to extract sensitive information from the WordPress database. The issue is resolved in version 4.2.1.
Affected products
- Imagely NextGEN Gallery < 4.2.1
Timeline
- 2026-04-07: other: Tenable sends request for contact
- 2026-04-14: other: Vendor acknowledgement
- 2026-04-15: other: Tenable sends details to vendor
- 2026-05-20: disclosed: Initial advisory release