CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevart Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
Explanation of Vulnerability in Simple Terms
Responsive Image Gallery and Gallery Album versions up to 2.0.3 contain a SQL injection vulnerability. An authenticated user with low privileges can craft malicious input to execute arbitrary SQL queries against the site's database. This can expose sensitive data or disrupt database operations. Update to a version newer than 2.0.3.
What an attacker can do
Execute SQL queries to read or modify database contents, including user data and site configuration.
Potential impact on your site
Attackers with basic user accounts can steal sensitive data from your database or cause service disruption.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
