A high-severity blind SQL injection vulnerability in the gopiplus New Simple Gallery plugin permits authenticated attackers to compromise database confidentiality and integrity.

This flaw is a blind SQL injection (CWE-89) arising from improper neutralization of special elements in database commands. It requires the attacker to hold at least low-level authenticated privileges to trigger the vulnerable code path.

The ability to perform blind SQL injection poses a significant risk to organizational data. An attacker can systematically extract sensitive information from the underlying WordPress database, potentially leading to unauthorized data access or complete compromise of site-specific user information. With a CVSS score of 8.5, this vulnerability is considered high severity and warrants immediate attention to prevent data exfiltration.

Immediate Action: Since no official patch is currently confirmed, administrators should immediately deactivate and remove the New Simple Gallery plugin until a secure update is released by the vendor.

Proactive Monitoring: Review database error logs and query logs for unusual patterns or syntax errors that suggest automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns, such as UNION SELECT or blind injection time-delay payloads.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for unauthorized data access, the risk associated with this plugin is substantial. Administrators must prioritize the removal of the vulnerable software to eliminate the attack surface entirely, as there is currently no verified remediation patch available.