InPost Gallery EUVD-2026-37046

No special conditions - remote unauthenticated exploitation against default configurations of the InPost Gallery WordPress plugin at version 2.1.4.6 or earlier, reachable over HTTP/HTTPS on the public-facing WordPress site. The only prerequisites are that the plugin is installed and activated and that the vulnerable endpoint (not enumerated in the provided advisory snippet) is reachable by the attacker. Limiting factors: the plugin must be present (not bundled with WordPress core, so only sites that explicitly installed it are affected), and the vulnerable endpoint must not be blocked by a pre-existing WAF or IP allowlist; no user interaction, no authentication, and no non-default configuration is required.

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates network-reachable, low-complexity, no-auth, no-user-interaction exploitation - the worst-case prerequisite profile. Impact metrics are unusual: C:H (high confidentiality, consistent with data extraction via UNION-based SQLi), I:N (no integrity impact, suggesting the injection point is read-only - likely a SELECT context rather than INSERT/UPDATE), and A:L (low availability, consistent with heavy queries causing DB load). EPSS is not provided in the input and the vulnerability is not on CISA KEV, so widespread automated exploitation is not confirmed; however, WordPress plugin SQLi reported by Patchstack is routinely incorporated into mass-scanning toolchains within days, so absence of KEV listing should not be read as low priority. No public exploit identified at time of analysis, but the CVSS-asserted I:N rating should be verified against the actual Patchstack advisory - defenders should not assume database writes are impossible without confirming the exact injection sink.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable InPost Gallery endpoint on a public WordPress site, embedding a UNION-based or boolean-blind SQL payload in a parameter consumed by the plugin. The injected query extracts wp_users password hashes, wp_options secret_keys, or session tokens from the WordPress database, which the attacker then uses to pivot to administrator account takeover and full site compromise. No public exploit identified at time of analysis, but the CVSS AV:N/AC:L/PR:N/UI:N profile means automated mass-scanning campaigns can trivially weaponize details once the patch diff or advisory specifics are public.