The vulnerability is a time‑based SQL injection in the 'gmedia__in' parameter of the Gmedia Photo Gallery plugin for WordPress. The input is concatenated directly into an SQL query without adequate escaping or prepared statements, allowing an attacker to append arbitrary SQL statements. Because the endpoint is exposed to unauthenticated users—including a mobile‑app route that does not require a nonce or WordPress authentication—any visitor can exploit this flaw. The consequence is the ability to read or modify data in the database, potentially exposing user credentials, permissions, media metadata, or other sensitive information.

Affected vendors and products are the Gmedia Photo Gallery plugin released by pasyuk. All released versions up to and including 1.25.1 contain the flaw. Users running private or custom builds may be at risk if they have not upgraded past that version. The plugin is typically installed on WordPress sites that enable the mobile‑app functionality via the library action endpoint.

With a CVSS score of 7.5 the vulnerability is classified as high severity. The EPSS score of less than 1 % indicates that exploitation is currently unlikely, and the issue is not listed in CISA’s KEV catalog. Nevertheless, because authentication is not required and the flaw allows data extraction, organizations should treat the risk as significant. The attacker requires only the ability to send HTTP requests to the vulnerable endpoint; no elevated privileges are needed to extract database contents.