What is the CVSS score of CVE-2026-57642?

CVE-2026-57642 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Gallery Plugin are affected by CVE-2026-57642?

A SQL injection vulnerability in WordPress Gallery plugin v4.7.8 and earlier allows authenticated contributors to access the WordPress database directly, potentially exposing sensitive data including…

How to fix or mitigate CVE-2026-57642?

Within 24 hours: Audit all contributors and subscriber accounts; disable self-registration if not operationally required. Within 7 days: Either remove Gallery plugin entirely, restrict it via Web Application Firewall rules to block SQL metacharacters in plugin parameters, or implement database-level access controls (read-only for contributor role). Within 30 days: Establish a vendor update monitoring process for Gallery plugin; evaluate alternative gallery solutions with active security patches.

Gallery Plugin CVE-2026-57642

EUVD-2026-39757 HIGH

SQL Injection (CWE-89)

2026-06-26 audit@patchstack.com

GHSA-pj5w-v4fq-q95p

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Contributor account required so PR:L; network, low-complexity, no interaction; SQLi reads database (C:H) with limited write potential (I:L) and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:49 vuln.today

DescriptionCVE.org

Contributor SQL Injection in Gallery <= 4.7.8 versions.

AnalysisAI

SQL injection in the WordPress 'Gallery' plugin (gallery-plugin) through version 4.7.8 lets authenticated low-privilege users (Contributor role and above) inject crafted SQL via plugin-handled parameters, exposing the WordPress database. Tracked as CVE-2026-57642 (CWE-89) and reported by Patchstack, the flaw carries a CVSS 3.1 base score of 8.5; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. A Contributor account is required, which limits exploitation to sites that allow self-registration or otherwise provision contributor-level access.

Technical ContextAI

The affected component is the BestWebSoft-style 'Gallery' plugin for WordPress, a PHP-based extension that manages image galleries through the WordPress admin and database layer. The root cause is CWE-89 (improper neutralization of special elements in an SQL command): user-controllable input reaches a database query without proper parameterization/escaping, allowing the attacker to alter query structure. WordPress plugins typically build queries against the shared MySQL/MariaDB backend using $wpdb; when developer code concatenates request parameters instead of using $wpdb->prepare(), an attacker with access to the vulnerable gallery endpoint can manipulate the resulting query. No CPE strings were supplied in the input, so the precise affected configuration is identified only by the plugin slug 'gallery-plugin' and the version ceiling of 4.7.8.

RemediationAI

Upgrade the Gallery plugin to a release later than 4.7.8 as soon as the vendor publishes a fixed version; the input data does not contain an exact patched version number, so confirm the fixed release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/gallery-plugin/vulnerability/wordpress-gallery-plugin-4-7-8-sql-injection-vulnerability?_s_id=cve) - patch status is best described as no specific vendor-released fix version identified in the available data. Because exploitation requires a Contributor account, the most effective compensating controls are to disable open user registration (Settings > General > 'Anyone can register') or lower the default new-user role below Contributor, and to audit existing Contributor/Author accounts for untrusted users; the trade-off is reduced ability for legitimate guest authors to self-register. As an additional layer, deploy a WordPress WAF (for example Patchstack's virtual patch or equivalent ruleset) to block SQL injection patterns against the plugin endpoints, accepting the usual risk of false positives on legitimate gallery requests. If the plugin is not essential, deactivating and removing it eliminates the exposure entirely.