Description

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the '_gallery_order_{post_id}' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The `gllr_save_postdata()` function stores unsanitized array keys from `$_POST` directly into post meta, which are later used in SQL queries without prepared statements. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-16T07:16:31.030Z",
  "pubdate": "2026-08-16T07:16:31.030Z",
  "executiveSummary": "An authenticated SQL Injection vulnerability has been identified in the Gallery by BestWebSoft plugin for WordPress across all versions up to, and including, 4.7.9. The security flaw stems from insufficient escaping of user-supplied inputs and a complete lack of query preparation within the underlying codebase. Specifically, the vulnerability resides in the handling of the _gallery_order_{post_id} parameter array keys, which are processed via the gllr_save_postdata() function. This function ingests unsanitized array keys directly from the $_POST superglobal and subsequently stores them into the WordPress post meta storage without adequate validation or sanitization. Later in execution, these stored meta values are concatenated directly into active database queries without utilizing parameterized statements. Consequently, malicious actors possessing administrative or editor-level privileges can leverage this flaw to append arbitrary SQL commands to existing database queries. Successful exploitation of this vulnerability enables authenticated attackers to extract sensitive information from the underlying database, potentially compromising the integrity, confidentiality, and overall security posture of the affected WordPress installation.",
  "technicalDetails": "The vulnerability is an SQL Injection (SQLi) flaw localized within the Gallery by BestWebSoft plugin, impacting all versions up to, and including, 4.7.9. The root cause of the vulnerability lies in improper input handling and insecure database interaction mechanisms. Specifically, the vulnerable component is the gllr_save_postdata() function, which is responsible for processing and saving post metadata during post updates or creation routines.\nDuring the execution of gllr_save_postdata(), the application extracts parameter array keys from the _gallery_order_{post_id} parameter supplied within the $_POST request. The function improperly ingests these user-supplied array keys without performing adequate sanitization, escaping, or type casting. These unsanitized values are then directly written into the WordPress post meta database table. When the application subsequently retrieves and utilizes these post meta values within subsequent database queries, it fails to employ prepared statements or parameterized queries.\nThe attack flow proceeds as follows: 1) An authenticated attacker with Editor-level access or higher crafts a malicious HTTP POST request targeting the post-saving functionality of the WordPress backend. 2) Within this request, the attacker injects SQL payloads into the array keys of the _gallery_order_{post_id} parameter. 3) The gllr_save_postdata() function processes the request and persists the malicious, unsanitized array keys directly into the post meta database table. 4) During subsequent application execution, the stored post meta values are dynamically concatenated into existing SQL query strings. 5) The database management system executes the resulting malformed query, allowing the attacker's injected SQL commands to append to or alter the original query logic.\nExploitation requirements dictate that the attacker must possess authenticated access with Editor-level privileges or higher. The network exposure is restricted to the administrative backend of the WordPress installation where authenticated users interact with post management features. The post-exploitation impact includes the ability to perform blind or error-based SQL injection attacks, leading to the unauthorized extraction of sensitive information residing in the database, such as user credentials, configuration data, and other restricted records."
}