The vulnerability arises from improper validation of a quantity value supplied by a user. This oversight allows an attacker to call protected functions that are not properly constrained by access control lists, leading to the ability to execute arbitrary code within the WordPress environment. The weakness is a direct example of an input validation flaw.

Vendor GalleryCreator distributes the SimpLy Gallery WordPress plugin. Any installation of the plugin from the initial release through version 3.3.2 is affected. Administrators are encouraged to check the plugin version they have deployed and compare it against the stated limit.

A CVSS score of 9.9 indicates critical severity, while an EPSS score of less than 1% suggests low current exploit probability. The vulnerability is not listed in the CISA KEV database, implying no confirmed exploits in the wild yet. An attacker would likely leverage HTTP requests crafted to submit an unvalidated quantity, thereby triggering the ACL bypass and code execution. The attack vector is inferred to be remote, via a web request, and would require the attacker to have access to the front‑end or an authenticated user session to submit the malicious input.