WordPress photo plugin opens 'a million sites' to SQLi database feasting • The Register

https://www.theregister.co.uk/2017/03/01/wordpress_nextgen_gallery_sqli/