The Gallery plugin for WordPress, up to version 4.7.8, contains a contributor SQL injection flaw that allows an attacker to insert malicious SQL statements through unsanitized input fields. This can enable the attacker to read, modify, or delete data stored in the plugin's database tables, potentially leading to data leakage or complete compromise of the WordPress site.

BestWebSoft Gallery, a WordPress gallery plugin, is affected. All releases of the plugin with version numbers 4.7.8 and earlier are impacted. Users running any of these versions should verify their installations for the vulnerability.

With a CVSS score of 8.5, the flaw is considered high severity, although EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, whereby an outsider can supply crafted parameters via public web forms or URLs to activate the injection. Exploitation does not appear to require prior authentication, so it can affect any visitor to the site. The lack of mitigation information implies that the flaw can be exploited if the plugin is in use and unpatched.