ZoomIt DZS Video Gallery SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the ZoomIt DZS Video Gallery plugin for WordPress, affecting versions through 12.37. This vulnerability arises from improper neutralization of special elements used in SQL commands, allowing malicious actors to manipulate database queries. Exploitation of this vulnerability could lead to unauthorized database access and data manipulation.

Impact

Exploitation of this vulnerability allows for direct interaction with the database, potentially leading to unauthorized data access, data manipulation, or data theft.

Remediation

Users are advised to update to a version of the DZS Video Gallery plugin for WordPress that is later than 12.37. For those seeking immediate protection, Patchstack has issued a mitigation rule that can be applied to block attacks targeting this vulnerability.