NGG Smart Image Search CVE-2026-73185

Exploitation requires only that the NGG Smart Image Search plugin (version below 4.0.0) be installed and active, with its image-search endpoint reachable over the network; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication and no user interaction are needed against a default installation. The specific prerequisite is that the attacker must be able to reach the plugin's search request handler (front-end search form or its AJAX action), which is exposed by design when the search feature is used on the site. Limiting factors that reduce real-world exposure: the site must actually have this particular plugin installed and enabled (a niche NextGEN-related add-on rather than core WordPress), and any WAF or access restriction in front of the search endpoint would raise the effective attack complexity.

The signals are largely aligned toward high priority for exposed installs: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation, and the 9.3 base score is driven by S:C and C:H. However, several signals are missing that temper an emergency rating - no EPSS probability was supplied, the CVE is not in CISA KEV (no evidence of active exploitation), and no POC/exploit availability is indicated in the provided intelligence. There is one internal inconsistency worth noting: the vendor vector sets I:N and only A:L, which is unusual for SQLi (which often permits data modification); this suggests a read-oriented or blind injection, so treat integrity impact as unconfirmed rather than assuming full read/write compromise. Net: a genuinely serious unauthenticated SQLi for any site running the plugin, but real-world exploitation pressure is currently unproven and depends heavily on how widely the plugin is deployed.

An unauthenticated attacker locates a WordPress site running NGG Smart Image Search below 4.0.0 and submits a crafted search request whose parameter breaks out of the intended SQL query. Using boolean/time-based blind or UNION techniques, they extract administrator password hashes and secret keys from wp_users and wp_options, then attempt offline cracking or session forgery to escalate to site takeover. Because AC:L and PR:N/UI:N apply, the request requires no login and no victim interaction, making the attack easily automatable at scale even though no public POC is currently identified.