The Owl carousel responsive WordPress plugin contains a time‑based SQL injection flaw in the id parameter of db_gallery.php. Because the parameter is concatenated directly into a query without escaping or prepared statements, an attacker can inject additional SQL statements. The vulnerability is limited to authenticated users with Contributor level or higher, enabling extraction of sensitive database information. The weakness falls under CWE‑89, an injection flaw that compromises confidentiality.

All installations of the Owl carousel responsive plugin from gopiplus up to and including version 1.9 are impacted. The plugin is distributed through WordPress and used by sites that have Contributor‑level accounts granted to users. No other versions are affected, and versions newer than 1.9 are presumed to have the fix.

The CVSS score of 8.8 flags this as a high‑severity vulnerability, even though the EPSS score of less than 1% suggests a low current exploitation probability. The attack requires knowledge of a Contributor account, which most sites already have for content authors, but it is not globally available. The flaw does not bypass authentication completely; it relies on an existing privilege. Because the injected query is time‑based, an attacker could simply wait for a latency delay to confirm a successful injection, indicating that exploitation is feasible in practice, even if automated exploitation is rare. The vulnerability is not listed in the CISA KEV catalog at this time.