EUVD-2026-89875
GHSA-jgpc-9333-vh2w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Books Gallery <=4.8.3
-
DeliverySend crafted request with SQL payload
-
ExploitTrigger injection in unsanitized parameter
-
ExecutionExtract database contents (credentials/secrets)
-
ImpactEscalate to site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the target WordPress site has the Books Gallery (wp-books-gallery) plugin installed and activated at version 4.8.3 or earlier; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are needed - a remote unauthenticated attacker can reach the vulnerable parameter directly over HTTP. The primary limiting factor is deployment scope: only sites actually running this specific, low-adoption plugin are exposed. The exact request parameter and endpoint are not specified in the available data, which slightly raises the practical effort to weaponize absent a POC. |
| Impact | This is a genuinely high-priority issue by its intrinsic characteristics: the provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated SQL injection, which is the most attacker-favorable combination possible. CWE-89 in a WordPress plugin means an attacker can craft malicious SQL through a request parameter to read database contents (C:H) - typically wp_users credential hashes, secret keys, and session/nonce material. However, no EPSS score, no SSVC decision data, no KEV listing, and no POC indicator were supplied, so exploitation-probability signals are entirely absent; per precision rules this is 'no public exploit identified at time of analysis.' The vendor vector's S:C/I:N/A:L composition is somewhat unusual for SQLi (which normally yields I:H when write access is possible); the C:H/I:N/A:L profile suggests Patchstack assessed a read-oriented, likely blind or UNION-based injection rather than one enabling data modification. The mitigating counterweight is prevalence: Books Gallery is a small-footprint WordPress plugin, so despite the near-worst-case exploitability, real-world exposure is limited to the subset of sites running it. Net: treat as a real priority for any site running wp-books-gallery <= 4.8.3, but the low install base bounds mass-exploitation risk compared to a flaw in a top-tier plugin. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a vulnerable Books Gallery endpoint on a WordPress site, injecting SQL into an unsanitized parameter. The injected query extracts sensitive rows from the WordPress database (e.g., administrator password hashes and secret keys from wp_users/wp_options). No POC or exploit code is referenced in the provided data, and exploitation requires no authentication or user interaction per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated SQL injection in the WordPress Books Gallery plugin (wp-books-gallery) 4.8.3 and earlier lets a remote attacker read arbitrary data from the site's WordPress database over plain HTTP, with no credentials and no user interaction required. Exposure is limited to sites that actually have this low-adoption plugin installed and activated, and no public exploit code was identified at time of analysis; there is no CISA KEV entry for this issue. Because the assessed impact is high confidentiality with only a low availability effect, the realistic worst case is full database disclosure - user password hashes, private content and configuration secrets - rather than code execution or data tampering.
RemediationAI
No vendor-released fixed version is identified in the available data and no upstream commit or pull request is cited, so the safest immediate action is to deactivate and, if it is not business-critical, uninstall the Books Gallery (wp-books-gallery) plugin entirely - the trade-off is loss of the plugin's book gallery display functionality, but that is preferable to an unauthenticated database-read flaw with no confirmed fix. If the plugin must stay online, compensate in layers: place a web application firewall or reverse-proxy rule in front of the site that inspects and blocks SQL-injection patterns (UNION SELECT, stacked queries, time-based constructs such as SLEEP/BENCHMARK) against the plugin's request paths, accepting that signature-based filtering is bypassable by encodings and blind-injection techniques; restrict or deny public access to plugin endpoints via server-level ACLs if the gallery is only used on internal or low-traffic pages, accepting that this can break legitimate front-end rendering; and minimize blast radius by making sure the WordPress database user has only the privileges the site needs, so that even successful injection cannot reach other schemas on the same database server. Regardless of the chosen mitigation, monitor the site's access logs for anomalous query strings hitting plugin URLs and watch the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-books-gallery/vulnerability/wordpress-books-gallery-plugin-4-8-3-sql-injection-vulnerability?_s_id=cve for a patched plugin release, which should be applied as soon as it becomes available and verified against the version reported by the site's plugin inventory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic CWE-89 SQL injection in a WordPress plugin: Books Gallery (wp-books-gallery, vendor record cpe:2.3:a:hossni_mubarak:books_gallery:*:*:*:*:*:*:*:*) constructs database queries against the WordPress MySQL/MariaDB backend, and attacker-controlled input reaches those queries without proper sanitization or parameterization, allowing injected SQL syntax to change the executed statement. Our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L - network-reachable, low complexity, no privileges (PR:N) and no user interaction (UI:N), the most attacker-favorable authentication profile, with scope assessed as unchanged (S:U) so the impact is confined to the WordPress application and its database rather than the underlying host. The high confidentiality / low availability / no integrity profile is consistent with UNION- or boolean/error-based extraction of data, which may include the wp_users table with password hashes and salts, plus the low-availability effect typical of injectable queries that can introduce delays or heavy table scans. The specific vulnerable endpoint and request parameter are not disclosed in the available data, which raises the practical effort to weaponize the issue absent a proof of concept. The only reference is a Patchstack vulnerability database entry for the plugin at version 4.8.3, which is the authoritative source for the underlying report.
Know when Books Gallery gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Remote unauthenticated SQLi (AV:N/AC:L/PR:N/UI:N) yielding database read (C:H); I:N and A:L retained per vendor, but S:U as injection stays within the app/DB trust boundary.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.
Executive ViewAI
The WordPress Books Gallery plugin (wp-books-gallery) versions 4.8.3 and earlier contain a critical SQL injection vulnerability that could allow a remote attacker to read arbitrary data from the site's database. Organizations running this low-adoption plugin are at risk of full database disclosure, including user password hashes, private content, and configuration secrets, which could lead to credential compromise and regulatory breach notification. Although no public exploit code or active exploitation has been identified, the lack of a vendor patch and the critical severity warrant immediate attention for affected sites.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling or removing the wp-books-gallery plugin if not essential; if required, deploy a web application firewall (WAF) with SQL injection signatures and virtual patching, restrict database user privileges to least privilege, and monitor logs for anomalous queries or data exfiltration attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB