A high-severity SQL injection vulnerability in the Pixelating image slideshow gallery plugin allows authenticated attackers to compromise backend database information.

This vulnerability is caused by improper neutralization of special elements used in an SQL command (CWE-89). It requires an attacker to have low-level authenticated access to the target WordPress instance to successfully inject malicious SQL queries.

The ability to perform SQL injection allows an attacker to bypass security controls and access sensitive information stored within the WordPress database, such as user credentials, configuration details, or plugin-specific data. With a CVSS score of 8.5, this flaw poses a significant risk to data confidentiality and integrity, potentially leading to unauthorized data exfiltration or system disruption.

Immediate Action: Since no official patch is currently identified, administrators should immediately deactivate and remove the Pixelating image slideshow gallery plugin until a secure version is released by the vendor.

Proactive Monitoring: Review database query logs for unusual or long-running queries, especially those originating from user accounts with administrative or editor permissions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection patterns targeting the plugin's endpoints.

Public Exploit Available: No (exploit_available: unknown).

Given the high CVSS score, this vulnerability represents a critical risk to the security of the host application and its underlying database. Organizations currently utilizing this plugin must prioritize its immediate removal to prevent potential unauthorized data access, as there is currently no verified vendor patch available to remediate the underlying code defect.