Description

Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-09-30T13:17:31.750Z",
  "pubdate": "2026-09-30T13:17:31.750Z",
  "executiveSummary": "The Books Gallery plugin for WordPress is susceptible to an unauthenticated SQL Injection vulnerability in versions 4.8.3 and below.\nThis vulnerability stems from improper neutralization of special elements used in an SQL command, allowing an unauthenticated remote attacker to manipulate database queries.\nSuccessful exploitation permits unauthorized access to the underlying database, potentially leading to sensitive data exposure, unauthorized modification of records, or complete compromise of the WordPress application data.\nThe flaw does not require authentication, meaning any network-reachable attacker can execute arbitrary SQL queries against the database without possessing valid user credentials.\nGiven that this vulnerability affects the integrity and confidentiality of the application's data layer, it presents a critical risk to site security and organizational data privacy.\nRemediation requires immediate update or replacement of the affected software component to prevent unauthorized data exfiltration or potential remote code execution via database-level interactions.",
  "technicalDetails": "The vulnerability resides in the way the Books Gallery plugin handles user-supplied input parameters within its database query construction logic. Specifically, the application fails to utilize parameterized queries or adequate input sanitization when processing requests before passing them to the database management system.\nThe root cause is the inclusion of unsanitized input into SQL statements. When an attacker sends a crafted request, the injected SQL payload is executed directly by the database engine. Because this endpoint is reachable without an active session, an unauthenticated attacker can manipulate the query structure to bypass security checks.\nThe exploitation flow initiates when an attacker transmits a maliciously crafted HTTP request targeting the vulnerable parameter. This payload typically includes SQL syntax designed to terminate the intended query and append a secondary, malicious query via a UNION-based or time-based injection technique.\nBy manipulating the SQL syntax, the attacker can force the database to return records from internal tables, including sensitive metadata, user credentials, or system configuration strings. If database permissions allow, an attacker could also perform data modification, such as updating administrative account email addresses or passwords, to escalate privileges.\nThe lack of authentication requirements significantly lowers the barrier to entry for potential attackers, as the vulnerability is exposed directly to the network. No prior interaction with the WordPress administration interface is necessary to trigger the flaw.\nPost-exploitation impact is severe. An attacker can leverage the SQL Injection to extract the entire contents of the database, leading to mass data breaches of user information. Furthermore, if the database user associated with the web application possesses excessive privileges (e.g., FILE access or administrative rights), an attacker might transition from SQL Injection to complete server compromise by writing web shells or executing OS-level commands through database functions.\nThe vulnerability persists across all versions of the plugin up to and including version 4.8.3, indicating a long-standing weakness in the component's data access layer that lacks the necessary abstraction to prevent injection attacks."
}