EUVD-2026-59925
GHSA-p9qr-8pg6-7hvc
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
PR:H reflects mandatory Editor-level WordPress authentication; AV:N and AC:L because exploitation is straightforward once that access exists; full C/I/A:H due to unrestricted database read/write via SQL injection.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the '_gallery_order_{post_id}' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The gllr_save_postdata() function stores unsanitized array keys from $_POST directly into post meta, which are later used in SQL queries without prepared statements. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the Gallery by BestWebSoft WordPress plugin (all versions through 4.7.9) allows Editor-level or higher authenticated attackers to exfiltrate or manipulate the entire WordPress database by injecting arbitrary SQL via crafted array key names in the _gallery_order_{post_id} POST parameter. The gllr_save_postdata() function writes these unsanitized array keys directly into post meta without escaping or prepared statements, and downstream SQL queries consume them verbatim. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with Editor role or higher (corresponding to CVSS PR:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.2 (High) score reflects the full database impact (C:H/I:H/A:H) but is tempered by PR:H, requiring Editor-level WordPress access - a role that typically requires administrative delegation and is not self-registerable in default WordPress configurations. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Gallery by BestWebSoft plugin to the version following 4.7.9; a fix commit is documented in the WordPress plugin Trac changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3609291%40gallery-plugin&new=3609291%40gallery-plugin, indicating the issue has been addressed upstream. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all user accounts with Editor or Administrator roles, document essential personnel with these permissions, and implement role restrictions where possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today