Description

The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 6.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability exists across two execution paths — $wpdb->get_var() in record_count() and $wpdb->get_results() in prepare_items()/get_image_categories() — enabling both blind and UNION-based exfiltration techniques.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-01T05:17:10.157Z",
  "pubdate": "2026-09-01T05:17:10.157Z",
  "executiveSummary": "The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress, in versions up to and including 6.8.2, contains a critical SQL injection vulnerability.\nThe flaw originates from improper input sanitization and lack of parameterized queries within the plugin's administrative interface.\nAn authenticated attacker with administrator-level privileges can exploit this vulnerability to execute arbitrary SQL commands against the underlying WordPress database.\nThis vulnerability enables unauthorized data exfiltration, including sensitive information stored within the database, by leveraging both blind and UNION-based SQL injection techniques.\nThe impact is significant, as it grants high-privileged users the ability to compromise the integrity and confidentiality of the site's data.\nExploitation requires administrative access, limiting the attack vector to authenticated users, though the potential for data breach remains severe once triggered.",
  "technicalDetails": "The vulnerability is localized within the 's' parameter, which is processed by the plugin without adequate escaping or the use of prepared statements.\nThe affected execution paths are identified within the 'record_count()' function, utilizing '$wpdb->get_var()', and within 'prepare_items()' and 'get_image_categories()', which utilize '$wpdb->get_results()'.\nThe root cause is the direct inclusion of user-supplied data from the 's' parameter into SQL queries executed via the WordPress database abstraction layer ($wpdb) without proper sanitization (e.g., $wpdb->prepare()).\nBecause the input is treated as trusted data, an attacker can perform query concatenation to append malicious SQL commands to the original query structure.\nIn the context of 'prepare_items()' and 'get_image_categories()', the vulnerability allows for UNION-based SQL injection. By crafting a specific payload in the 's' parameter, an attacker can append a UNION SELECT statement, enabling them to retrieve data from arbitrary tables within the database schema.\nIn the context of 'record_count()', the vulnerability supports blind SQL injection. By observing the responses (such as conditional page contents or timing variations), an attacker can systematically infer data byte-by-byte, even if direct results are not returned to the UI.\nThe attack flow requires an attacker to authenticate with administrator-level access. Once logged in, the attacker initiates a request to the vulnerable plugin component, injecting a malicious payload into the 's' parameter. The plugin's code fails to properly validate this input, passing the unsanitized string directly into the query execution functions.\nThis behavior results in the execution of the attacker's injected SQL code with the privileges of the database user configured for the WordPress installation. Successful exploitation leads to unauthorized access to the database, potentially exposing user credentials, administrative configurations, or other sensitive business information.\nThe lack of prepared statements ensures that the database engine cannot distinguish between the intended command and the injected payload, effectively handing control of the database query execution to the attacker."
}