Which versions of NextGEN Gallery are affected by CVE-2026-9059?

The NextGEN Gallery WordPress plugin (Awesome Motive) versions before 4.2.1 contain a critical vulnerability allowing unauthorized database access and data theft.. A patch is available.

How to fix or mitigate CVE-2026-9059?

Within 24 hours: Identify all WordPress installations using NextGEN Gallery and document current versions. Within 7 days: Update NextGEN Gallery to version 4.2.1 or later on all affected sites; review administrator role assignments and restrict the 'NextGEN Gallery overview' capability to only essential personnel. Within 30 days: Verify all systems are patched to 4.2.1 or later; audit admin user activity logs and database access records for anomalous behavior.

NextGEN Gallery CVE-2026-9059

Q: What is the CVSS score of CVE-2026-9059?

CVE-2026-9059 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31073 CRITICAL

SQL Injection (CWE-89)

2026-05-20 tenable

GHSA-q977-85xc-w698

SQLi Nextgen Gallery

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 09:30 vuln.today

Patch available

May 20, 2026 - 09:01 EUVD

DescriptionCVE.org

NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'.

The root cause is an insufficient sanitization function ('_clean_column()') in the data mapper layer that uses a character blacklist instead of a whitelist approach. This allows an authenticated attacker with the 'NextGEN Gallery overview' capability (assigned to the Administrator role by default) to inject arbitrary SQL into the 'ORDER BY' clause.

AnalysisAI

Authenticated SQL injection in NextGEN Gallery (WordPress plugin by Awesome Motive/Imagely) before version 4.2.1 allows attackers holding the 'NextGEN Gallery overview' capability - granted to Administrators by default - to inject arbitrary SQL via the 'orderby' parameter on the '/imagely/v1/galleries' and '/imagely/v1/albums' REST endpoints. CVSS 4.0 rates this 9.3 due to high confidentiality, integrity, and scope impact; no public exploit identified at time of analysis, but the issue was reported by Tenable Research (TRA-2026-42) and a vendor patch is available.

Technical ContextAI

NextGEN Gallery is one of the most widely deployed WordPress photo gallery plugins, distributed by Awesome Motive/Imagely (CPE cpe:2.3:a:awesomemotive:nextgen_gallery). The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) rooted in the plugin's data mapper layer, specifically the '_clean_column()' sanitization routine. That function uses a character blacklist rather than a column-name whitelist, which is a known-bad pattern for ORDER BY clauses because ORDER BY values cannot be parameterized through prepared statements and therefore require strict allow-listing. The injection sink is reached through two authenticated REST API routes registered under the '/imagely/v1/' namespace that pass user-supplied 'orderby' values into the underlying SQL.

RemediationAI

Upgrade the NextGEN Gallery plugin to version 4.2.1 or later, which Tenable's advisory (https://www.tenable.com/security/research/tra-2026-42) confirms contains the vendor-released patch. Where immediate upgrade is not possible, reduce risk by auditing and minimizing the set of accounts holding the 'NextGEN Gallery overview' capability - revoke it from any non-essential Administrator-tier users and review for stale or shared admin accounts, since exploitation requires this capability. As a temporary compensating control, restrict access to the '/wp-json/imagely/v1/galleries' and '/wp-json/imagely/v1/albums' REST routes at the WAF or web-server layer (e.g., block or filter requests containing suspicious 'orderby' values such as parentheses, UNION, SLEEP, or comment sequences); note this will break legitimate admin gallery sorting and may be bypassable through encoding. Rotate WordPress secrets and review the database for signs of unauthorized queries if exposure to untrusted admin accounts is suspected.