Description

Unauthenticated SQL Injection in Gmedia Photo Gallery <= 1.25.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-10-06T09:17:51.100Z",
  "pubdate": "2026-10-06T09:17:51.100Z",
  "executiveSummary": "The Gmedia Photo Gallery plugin for WordPress, specifically versions 1.25.1 and below, is susceptible to an unauthenticated SQL injection vulnerability.\nThis flaw allows remote, unauthenticated attackers to execute arbitrary SQL commands against the underlying database.\nThe vulnerability originates from improper neutralization of user-supplied input before it is incorporated into database queries.\nSuccessful exploitation grants an attacker the capability to bypass authentication, extract sensitive information, modify database contents, or escalate privileges within the WordPress environment.\nGiven that the vulnerability does not require authentication, the risk level is critical, as it can be exploited by any remote actor with access to the web server.\nThe compromise of the database can lead to full site takeover, unauthorized access to user accounts, and exposure of confidential data.",
  "technicalDetails": "The vulnerability resides within the Gmedia Photo Gallery plugin, affecting all versions up to and including 1.25.1. The root cause is the insufficient sanitization of input parameters processed by the plugin before they are used in SQL query construction.\nSpecifically, the plugin fails to properly validate and escape data provided by users via HTTP request parameters before passing them to the database layer. An attacker can inject malicious SQL syntax into these parameters, which is then executed by the database engine with the privileges of the database user configured for the WordPress application.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies a public-facing endpoint or request handler managed by the Gmedia Photo Gallery plugin that accepts user input. Second, the attacker crafts a malicious HTTP request, injecting SQL injection payloads—such as UNION-based, error-based, or blind SQL injection vectors—into the vulnerable parameter. Third, the application receives this input and integrates it directly into an SQL statement without utilizing prepared statements or adequate escaping functions like $wpdb->prepare(). Fourth, the database executes the modified query, returning the results of the attacker's injected logic to the application, which may reflect the output or reveal it through side-channel timing analysis.\nBecause the vulnerable component is reachable by unauthenticated users, no specific privileges or active session tokens are required to perform the attack. The exposure is total, as the plugin processes requests regardless of the user's logged-in status. The payload behavior can range from simple data exfiltration—such as reading wp_users tables or administrative credentials—to destructive operations like dropping tables or executing administrative commands if the database user permissions allow for stacked queries.\nThe technical failure is an Improper Neutralization of Special Elements used in an SQL Command (CWE-89). By manipulating the input, an attacker effectively bypasses the intended logic of the plugin, gaining direct interaction with the database. Post-exploitation impact is severe, as attackers can exfiltrate site configurations, hashed password sets, or other sensitive personal information stored within the WordPress database, potentially leading to a complete compromise of the hosting environment."
}