External risk intelligence

NGG Smart Image Search Unauthenticated SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-73185

The vulnerability exists in a WordPress plugin. WordPress plugins are typically deployed as part of public-facing web applications, making the vulnerable code directly reachable via standard web traffic from the internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in NGG Smart Image Search, a technology that may be integrated into your systems. This flaw allows unauthenticated attackers to potentially access or manipulate data through SQL injection. The primary concern is to confirm if this specific software is in use and assess any associated exposure.

Unauthenticated data access via SQL injection.
Confirm if NGG Smart Image Search is deployed.
Understand potential data exposure and risk.

Attack Path

How an attacker could exploit the issue

An attacker could target an unauthenticated SQL injection vulnerability in NGG Smart Image Search by sending specially crafted requests over the network. This exposure allows an unauthenticated user to potentially interact with the vulnerable component, leading to unauthorized access to database information and possible system disruption.

No authentication required for entry.
Triggered by network requests to the search feature.
Risk of data exposure and service disruption.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated SQL injection in NGG Smart Image Search could allow an attacker to access or manipulate database information, potentially impacting service availability when the plugin is deployed in a network-accessible environment.

Database information could be affected.
Exploitation may occur via network requests.
Service disruption or data exposure is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world remediation for this SQL injection vulnerability will likely involve collaboration between application owners responsible for the NGG Smart Image Search plugin and infrastructure or platform teams managing the web server environment. The initial focus should be on identifying all instances of the affected plugin, assessing their exposure to external networks, and determining their criticality to business operations. Once identified and prioritized, a coordinated patching or mitigation plan can be developed, potentially involving vendor coordination if a fix is available or the implementation of temporary compensating controls.

Application owners should own the issue.
Verify plugin reachability and business criticality.
Plan coordinated remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NGG Smart Image Search?

NGG Smart Image Search is a WordPress plugin designed to enhance how users find and manage images within a site's media library. It integrates into the content management system to provide specialized search functionality, often used by site administrators to improve media organization and accessibility for visitors.

What does SQL injection mean for CVE-2026-73185?

This vulnerability falls under the CWE-89 weakness class, which refers to Improper Neutralization of Special Elements used in an SQL Command. In plain terms, it means the plugin fails to properly filter the data it receives. An attacker can input malicious commands that trick the application's database into revealing restricted information or executing unintended actions.

How does an attacker trigger this vulnerability?

The flaw is triggered by sending specially crafted network requests directly to the plugin's search feature. Because the vulnerability is unauthenticated, no login or administrative permissions are required. Note that this issue specifically relates to how the search component processes input; normal administrative site actions that do not utilize this specific search query path are not the trigger.

Is my system at risk for CVE-2026-73185?

Your risk depends on whether you have this plugin active and exposed. According to Halo Surface Signal, because this is a WordPress plugin, it is typically part of a web application reachable via standard internet traffic. If your instance is internet-facing, it is directly accessible to external network requests, making it a priority for assessment.

What should I do if I use this plugin?

Start by identifying all websites running NGG Smart Image Search versions older than 4.0.0. Once identified, evaluate the plugin's necessity and its exposure to the internet. Coordinate with your web management team to plan for an update to version 4.0.0 or higher, which addresses this flaw, and consider restricting access if an immediate update is not possible.

References

patchstack.com/database/wordpress/plugin/ngg-smart-image-search/vuln…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.