PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9059 awesomemotive CVE debrief

CVE-2026-9059 is a critical authenticated SQL injection vulnerability in NextGEN Gallery versions prior to 4.2.1. The flaw exists in the REST API endpoints `/imagely/v1/galleries` and `/imagely/v1/albums`, where the `orderby` parameter is insufficiently sanitized by a `_clean_column()` function that employs a blacklist-based approach rather than a whitelist. An attacker with the 'NextGEN Gallery overview' capability—assigned to Administrator by default—can inject arbitrary SQL into the `ORDER BY` clause. The vulnerability was published on 2026-05-20 and carries a CVSS score of 9.3 (Critical). The root cause is categorized under CWE-89 (SQL Injection).

Vendor
awesomemotive
Product
NextGEN Gallery
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-05-20
Advisory published
2026-05-20
Advisory updated
2026-05-20

Who should care

WordPress site administrators, security operations teams, web application security engineers, and organizations running NextGEN Gallery plugin versions prior to 4.2.1.

Technical summary

The vulnerability stems from a `_clean_column()` sanitization function in the data mapper layer that uses character blacklisting instead of whitelisting. This insufficient validation allows authenticated administrators to manipulate the `orderby` parameter in REST API requests to `/imagely/v1/galleries` and `/imagely/v1/albums`, injecting arbitrary SQL into the `ORDER BY` clause. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H) indicates network exploitable, low attack complexity, high privileges required, but high impact on confidentiality, integrity, and availability of subsequent systems.

Defensive priority

Critical

Recommended defensive actions

  • Upgrade NextGEN Gallery to version 4.2.1 or later immediately.
  • Audit WordPress administrator accounts for unauthorized access or privilege escalation.
  • Review web server and database logs for suspicious ORDER BY clause anomalies in REST API requests to /imagely/v1/galleries and /imagely/v1/albums endpoints.
  • Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in REST API orderby parameters.
  • Restrict REST API access to trusted IP ranges where possible.
  • Verify database integrity and check for unauthorized data exfiltration or schema modifications.

Evidence notes

The vulnerability description and technical details are sourced from the official CVE record and NVD entry. The root cause analysis (blacklist vs. whitelist sanitization) and affected endpoints are explicitly documented in the CVE description. CVSS 4.0 vector confirms network attack vector with high privileges required but critical impact on confidentiality, integrity, and availability of system resources.

Official resources

The vulnerability was disclosed on 2026-05-20 via NVD and Tenable security research.