The plugin "Photo Gallery by Ays – Responsive Image Gallery" for WordPress contains a generic SQL injection flaw in the 's' parameter used by multiple backend functions. This flaw enables an attacker who has at least administrator privileges to inject and execute arbitrary SQL statements. The injected queries can be blind or UNION‑based, allowing extraction of confidential data from the database. Because the vulnerability requires legitimate WordPress credentials, the attack surface is limited to authenticated users with elevated roles; however, the impact includes potential theft of sensitive information and integrity compromise of site content.

Any WordPress installation running the Photo Gallery by Ays – Responsive Image Gallery plugin with a version number 6.8.2 or earlier is affected. The flaw exists across two execution paths in the plugin’s code that handle catalog rendering and category listing, meaning all installations with these versions are vulnerable if an attacker obtains administrator credentials.

The CVSS base score of 4.9 indicates a moderate risk, and absence of a KEV listing suggests there are no confirmed exploits in the wild at the time of analysis. The EPSS score is not available, but because the flaw requires authenticated access, an attacker would first need to compromise the login credentials of an administrator. Once authenticated, the plugin’s lack of proper input sanitization allows the attacker to append malicious SQL statements and exfiltrate data. The absence of a publicly disclosed exploit does not guarantee the vulnerability is safe, as the attack path is straightforward for users with admin privileges.