More than 1 million websites running the WordPress content management system may be vulnerable to hackers stemming from a severe SQL injection bug in NextGEN Gallery, a WordPress plugin. Mike Pittenger, President of Security Strategy at Black Duck Software, said many organisations are negligent in monitoring these vulnerabilities and upgrading to remediate the issue. This type of issue running old and vulnerable versions of open source made WordPress one of the main suspects in the Panama Papers breach (along with Drupal and Outlook Web Access).”]
Source: https://informationsecuritybuzz.com/articles/wordpress-sql-injection-bug-nextgen-gallery/