Gmedia Photo Gallery
Monthly
Unauthenticated time-based blind SQL injection in the Gmedia Photo Gallery plugin for WordPress, affecting all versions up to and including 1.25.1, lets any remote attacker append arbitrary SQL to the plugin's existing query through the 'gmedia__in' parameter and extract sensitive data from the site's database. The plugin's mobile-app endpoint dispatches the 'library' action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, so no account or session of any kind is required, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5). Impact is confidentiality-only and exploitation is blind and time-based, so extraction is slower and noisier than an error-based injection; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated SQL injection in the WordPress plugin Gmedia Photo Gallery (versions 1.25.1 and earlier) allows remote attackers to inject arbitrary SQL into database queries and read data the application can access, which the assessment rates as high confidentiality impact with no integrity or availability impact. Any WordPress site with the plugin installed and active is potentially exposed because exploitation requires no account, no privileges, and no victim interaction (AV:N/AC:L/PR:N/UI:N); the practical gate is deployment - the site must run an unpatched version and expose the vulnerable endpoint to the network. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the reporter's 9.3 score and the zero-prerequisite vector make it a high-priority item for inventory and patching rather than a CVSS-inflated finding.
Unauthenticated time-based blind SQL injection in the Gmedia Photo Gallery plugin for WordPress, affecting all versions up to and including 1.25.1, lets any remote attacker append arbitrary SQL to the plugin's existing query through the 'gmedia__in' parameter and extract sensitive data from the site's database. The plugin's mobile-app endpoint dispatches the 'library' action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, so no account or session of any kind is required, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5). Impact is confidentiality-only and exploitation is blind and time-based, so extraction is slower and noisier than an error-based injection; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated SQL injection in the WordPress plugin Gmedia Photo Gallery (versions 1.25.1 and earlier) allows remote attackers to inject arbitrary SQL into database queries and read data the application can access, which the assessment rates as high confidentiality impact with no integrity or availability impact. Any WordPress site with the plugin installed and active is potentially exposed because exploitation requires no account, no privileges, and no victim interaction (AV:N/AC:L/PR:N/UI:N); the practical gate is deployment - the site must run an unpatched version and expose the vulnerable endpoint to the network. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the reporter's 9.3 score and the zero-prerequisite vector make it a high-priority item for inventory and patching rather than a CVSS-inflated finding.