The Gallery by BestWebSoft plugin for WordPress contains a SQL injection vulnerability that allows high-privileged users to compromise the database and potentially execute unauthorized actions.

This is an SQL injection vulnerability (CWE-89) triggered by improper input sanitization of the gallery_order{post_id} parameter. The vulnerability requires the attacker to have high-level administrative privileges (authenticated) to trigger the malicious query.

A successful SQL injection attack can lead to unauthorized data extraction, modification, or deletion within the WordPress database. Given the CVSS score of 7.2, this vulnerability represents a significant risk to the integrity of the website and its associated data. Compromise of the database could lead to further unauthorized access or total site takeover.

Immediate Action: Update the Gallery by BestWebSoft plugin to version 4.8.0 or later immediately to patch the injection vector.

Proactive Monitoring: Monitor database query logs for suspicious or malformed SQL statements originating from administrative sessions.

Compensating Controls: Utilize a Web Application Firewall (WAF) to detect and block common SQL injection patterns targeting the gallery plugin parameters.

Public Exploit Available: Unknown

Administrators must verify the plugin version and apply the update to 4.8.0. If an immediate update is not feasible, restrict administrative access to the plugin settings to trusted users only.