EUVD-2026-62380
GHSA-96wp-h3p4-288v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi with low complexity (AV:N/AC:L/PR:N/UI:N); injection stays within the DB context so S:U, high confidentiality from data extraction, no confirmed write or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.
AnalysisAI
SQL injection in the NGG Smart Image Search WordPress plugin (all versions before 4.0.0) lets remote attackers inject arbitrary SQL through the plugin's search functionality without authentication. Because the CVSS vector marks privileges as none and user interaction as none, any visitor can reach the vulnerable query, and the scope-changed high-confidentiality rating (9.3) reflects potential exposure of the entire WordPress database, including credentials and secrets. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that the NGG Smart Image Search plugin (version below 4.0.0) be installed and active, with its image-search endpoint reachable over the network; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication and no user interaction are needed against a default installation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely aligned toward high priority for exposed installs: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation, and the 9.3 base score is driven by S:C and C:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker locates a WordPress site running NGG Smart Image Search below 4.0.0 and submits a crafted search request whose parameter breaks out of the intended SQL query. Using boolean/time-based blind or UNION techniques, they extract administrator password hashes and secret keys from wp_users and wp_options, then attempt offline cracking or session forgery to escalate to site takeover. … |
| Remediation | Vendor-released patch: 4.0.0 - upgrade the NGG Smart Image Search plugin to version 4.0.0 or later, which is the fixed release referenced in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ngg-smart-image-search/vulnerability/wordpress-ngg-smart-image-search-plugin-4-0-0-sql-injection-vulnerability). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all WordPress installations using NGG Smart Image Search and immediately disable or remove the plugin to eliminate the attack vector. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ngg Smart Image Search
View allSame weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today