Unauthenticated SQL Injection exists in the WordPress Books Gallery plugin versions up to and including 4.8.3. The flaw allows an attacker to inject arbitrary SQL queries into the plugin’s database interactions, potentially reading, modifying, or deleting sensitive data. This weakness is categorized under CWE-89, making it a classic injection vulnerability with high risk of compromise.

The vulnerability affects the Hossni Mubarak:Books Gallery plugin distributed for WordPress. All installations using version 4.8.3 or older are susceptible; no other product variants are listed as impacted.

With a CVSS score of 9.3, the flaw is considered critical. The EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalog, but the structure of the attack requires no authentication and relies on a public web interface, meaning an attacker can exploit it from any location. The combination of high severity, lack of authentication barrier, and typical exposure through a website suggests a high likelihood of exploitation if left unpatched.