A critical SQL injection vulnerability in the Gopiplus iFrame Images Gallery plugin, affecting versions 0 through 9.0, poses a significant risk of unauthorized database access.

The plugin fails to properly sanitize user input before passing it to an SQL command, resulting in a SQL injection vulnerability. Per the CVSS vector (PR:L), this flaw requires the attacker to have at least low-level authenticated access to the WordPress instance.

The ability to perform SQL injection allows an attacker to bypass security controls, potentially leading to unauthorized data exfiltration or modification. Given the CVSS score of 8.5, this high-severity flaw could lead to full compromise of the plugin data and potentially impact the integrity of the underlying WordPress database, causing significant operational disruption.

Immediate Action: As no patch is currently identified, administrators should immediately deactivate and uninstall the Gopiplus iFrame Images Gallery plugin until a secure version is released by the vendor.

Proactive Monitoring: Review database query logs for unusual patterns or syntax errors that suggest attempted injection attacks against the plugin's endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules specifically configured to detect and block common SQL injection patterns to reduce the attack surface.

Public Exploit Available: Unknown

Due to the lack of a verified patch and the high CVSS severity, the risk of maintaining this plugin in an active environment is unacceptable. Security teams must prioritize the immediate removal of the Gopiplus iFrame Images Gallery plugin from all production WordPress environments to prevent potential unauthorized database access.