A critical SQL injection vulnerability in the cybio Gallery Widget plugin allows authenticated attackers to potentially compromise database confidentiality and integrity.

This vulnerability is a classic SQL Injection (CWE-89) arising from the improper handling of user-supplied input. It requires the attacker to possess at least low-level (authenticated) privileges to interact with the vulnerable plugin components.

The ability to inject arbitrary SQL commands poses a significant risk to organizational data. Successful exploitation could lead to unauthorized access to sensitive database information, potential data exfiltration, or disruption of database services. With a CVSS score of 8.5, this high-severity flaw requires immediate attention to prevent unauthorized database manipulation.

Immediate Action: Since a specific patch version is not currently identified, users should monitor the official Patchstack advisory for updates and remove or deactivate the plugin if it is not mission-critical.

Proactive Monitoring: Security teams should review database query logs for anomalous syntax or suspicious patterns originating from the Gallery Widget plugin.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at WordPress plugin endpoints.

Public Exploit Available: Unknown.

Given the high CVSS score of 8.5, this vulnerability represents a significant risk to the integrity of the backend database. Administrators must prioritize the identification of all instances of the cybio Gallery Widget within their environment and prepare to disable the plugin until a verified security update is released by the vendor.