SUCURI, a leading WordPress security company, announced their finding of an SQL injection vulnerability in the popular NextGEN Gallery plugin.
This vulnerability can be exploited by attackers in at least two different scenarios:
1. If you use a NextGEN Basic TagCloud Gallery on your site.
2. If you allow your users to submit posts to be reviewed (contributors).
If you fit into any of these two cases, you’re definitely at risk.
This issue existed because NextGEN Gallery allowed improperly sanitized user input in a WordPress prepared SQL query; which is basically the same as adding user input inside a raw SQL query. Using this attack vector, an attacker could leak hashed passwords and WordPress secret keys in certain configurations.
SUCURI advises updating to the latest version of the NextGEN Gallery plugin now.
You can read more about the SQL injection vulnerability on the SUCURI Blog.
At Current Photographer we take security very seriously. With our Managed WordPress Hosting, we make sure that our client’s websites are backed up daily, and protected with multiple firewalls throughout our enterprise-grade infrastructure. Our real-time security threat detection, and security audits and code reviews help to keep client’s sites safe. Should a website become compromised, we will immediately take action to find the exploit, remove the malicious code, and have the site back up and running in no time.
*The Current Photographer website contains links to our affiliate partners. Purchasing products and services through these links helps support our efforts to bring you the quality information you love and there’s no additional cost to you.
Founder of Current Photographer, co-host of The Digital Photography Cafe Show, Designer, Photographer, and overall tech geek.