WordPress Gallery Widget SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the WordPress Gallery Widget plugin, affecting versions through 1.2.1. This vulnerability arises from improper neutralization of special elements used in SQL commands, allowing malicious actors to manipulate database queries and potentially access or modify database information.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to interact with the database of the affected WordPress site. This could include unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Remediation

Users are advised to remove and replace the WordPress Gallery Widget plugin, as it is likely abandoned and will not receive further updates or fixes. Deactivating the plugin does not eliminate the security risk unless a virtual patch is applied.