The Gallery Widget plugin accepts user‑supplied input and incorporates it into SQL statements without proper sanitization, creating a classic SQL Injection flaw (CWE‑89). This allows an attacker to build arbitrary SQL commands that can read sensitive data, alter or delete records, and potentially corrupt the WordPress database. The impact is limited to the data accessed by the WordPress installation but can lead to significant confidentiality and integrity violations.

Versions of the cybio Gallery Widget plugin up to and including 1.2.1 are affected. The vulnerability applies to any WordPress site that has this plugin installed and enabled, regardless of other plugins or themes, because the flaw is in the plugin’s core code.

The CVSS score of 8.5 indicates a high severity, and the EPSS score of less than 1% suggests that, at the time of analysis, compromise is unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending crafted requests to the gallery widget’s endpoints, which the plugin processes without sufficient input validation. Attacks would require network access to the website and knowledge of the plugin’s entry points, but once executed, an attacker can retrieve or manipulate database content.