The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL injection through the '_gallery_order_{post_id}' array keys. Untrusted input from authenticated users with Editor role or higher is stored directly in post meta without proper escaping and later used in SQL queries without prepared statements. This flaw allows an attacker to append arbitrary SQL to existing queries and extract sensitive database contents.

The vulnerability affects the Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress plugin, with all releases up through version 4.7.9. It does not involve the WordPress core itself but applies to sites that have this plugin installed and have users assigned the Editor or higher roles.

The CVSS score of 7.2 indicates high severity, and the exploitation probability is uncertain due to the lack of an EPSS value. The flaw is not listed in the CISA KEV catalog. Attackers must first authenticate with Editor-level access (or greater) and then submit crafted data via the gallery ordering interface. Successful injection enables database read access, potentially exposing user credentials, site configuration, and other confidential data. Though no public exploits are documented, the existence of a classic SQL injection vector means the risk remains significant for affected sites.