Gallery by BestWebSoft CVE-2026-2497

Exploitation requires an authenticated WordPress session with Editor role or higher (corresponding to CVSS PR:H). The vulnerability is triggered specifically by submitting a POST request to the gallery post-save endpoint that processes _gallery_order_{post_id} array keys, meaning the attacker must interact with the gallery management workflow - not arbitrary WordPress endpoints. The injection is stored (second-order): the malicious payload is first written to post meta via gllr_save_postdata(), then executed when that meta value is later incorporated into a SQL query. This two-stage nature means exploitation requires both write access (to save the payload) and a subsequent read/render trigger. Limiting factors: Editor role is not self-assignable in default WordPress; the Gallery by BestWebSoft plugin must be installed and active; and exploitation targets the WordPress database specifically, not the underlying OS.

The CVSS 7.2 (High) score reflects the full database impact (C:H/I:H/A:H) but is tempered by PR:H, requiring Editor-level WordPress access - a role that typically requires administrative delegation and is not self-registerable in default WordPress configurations. This substantially limits opportunistic exploitation; the realistic threat model is a malicious insider, a compromised Editor account, or a scenario where another vulnerability (e.g., credential stuffing, phishing) first establishes Editor access. No EPSS score was provided, and the vulnerability has no CISA KEV listing, suggesting no observed mass exploitation at time of analysis. The absence of a listed POC and KEV status, combined with the PR:H requirement, places real-world priority below what the raw CVSS score might suggest for most environments. However, for WordPress sites with multiple Editors or contributor workflows, the risk is elevated. CVSS I:H/A:H impact metrics are consistent with blind or error-based SQLi that can perform write operations or trigger heavy queries, not only read access.

An attacker who holds or has compromised a WordPress Editor account navigates to a gallery editing page and submits a crafted POST request where the keys of the _gallery_order_{post_id} array contain SQL fragments (e.g., 1 UNION SELECT user_login,user_pass,3 FROM wp_users-- -). The gllr_save_postdata() function stores these keys verbatim into post meta; when the plugin subsequently builds a SQL query using that stored meta value without prepared statements, the injected SQL executes against the WordPress database, returning hashed credentials or other sensitive data. No public proof-of-concept has been identified, but the code path is described in detail via the Trac source references, making independent exploitation straightforward for a skilled attacker.