NextGEN Gallery CVE-2026-9059

Requires an authenticated WordPress session belonging to a user with the 'NextGEN Gallery overview' capability (granted to the Administrator role by default, so in practice any account with the Administrator role or any custom role explicitly granted that capability). The target site must run NextGEN Gallery prior to 4.2.1 with its REST API reachable by the attacker (default WordPress configuration exposes '/wp-json/imagely/v1/galleries' and '/imagely/v1/albums' over the network). No user interaction by another party is required (UI:N), and no non-default plugin configuration is needed. The principal limiting factor is the PR:H authentication bar - this is not exploitable by anonymous visitors, subscribers, contributors, authors, or editors, only by accounts holding the privileged capability.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) describes a network-reachable, low-complexity attack that nonetheless requires high privileges, which materially narrows the realistic threat - an attacker must already hold the 'NextGEN Gallery overview' capability (Administrator by default). Impact metrics are severe (VC:H/VI:H, plus subsequent-system SC:H/SI:H/SA:H), reflecting that database read/write via SQLi on a WordPress install typically yields user hashes, secrets, and pivot opportunities into the broader site. Exploitation status: no public exploit identified at time of analysis, and the CVE is not on CISA KEV; EPSS data was not provided. The PR:H requirement means this is primarily a post-compromise privilege-amplification and persistence vector (e.g., a lower-trust admin, a compromised admin account, or a multi-tenant WordPress environment where 'admin' is not fully trusted) rather than an unauthenticated mass-exploitation risk. Treat as high priority where untrusted users hold admin-tier roles, otherwise standard patch-cycle priority.

An attacker who has compromised or otherwise obtained an Administrator-level WordPress account on a site running NextGEN Gallery <4.2.1 sends an authenticated GET to '/wp-json/imagely/v1/galleries' with a crafted 'orderby' parameter that escapes the ORDER BY clause and appends a UNION-based or time-based SQL payload. The injected query exfiltrates WordPress 'wp_users' password hashes, secret keys, and session tokens, which the attacker uses to escalate to persistent control across other admins or pivot to other sites sharing the database. No public PoC is identified at time of analysis, but the technical detail in Tenable TRA-2026-42 is sufficient to reproduce the issue.