The vulnerability is a SQL injection that can be triggered by supplying a crafted value to the 'postid' query parameter. An unauthenticated attacker can insert arbitrary SQL statements into the existing query, allowing the disclosure of database contents, including sensitive user data and content. The weakness arises from insufficient input validation and escaping (CWE-89).

The issue affects all installations of the PhotoStack Gallery plugin for WordPress with a version of 0.4.1 or earlier. The plugin is distributed through the WordPress plugin repository and is used by any WordPress site that has enabled PhotoStack Gallery.

The CVSS score of 7.5 indicates high risk, but the EPSS score is less than 1%, suggesting a low probability of current exploitation. The vulnerability is not listed in CISA's KEV catalog. The attack vector is external; an attacker only needs to craft a request to the plugin endpoint with a malicious 'postid' value. Because authentication is not required, any user could exploit it, potentially compromising confidential data.