CVE-2026-73185

SQL Injection vulnerability in NGG Smart Image Search plugin versions prior to 4.0.0. An unauthenticated attacker can inject SQL queries, potentially leading to unauthorized database access.

Risk includes data leakage, modification or deletion of database data, and in extreme cases server takeover. The attack can be performed remotely without authentication.

Update the NGG Smart Image Search plugin to version 4.0.0 or later. Also check for potential data breach.