Description

WordPress Plugin Meow Gallery (+ Gallery Block) is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin Meow Gallery (+ Gallery Block) version 4.1.8 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 4.1.9 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:08DBE202-0136-4502-87E7-5E984DC27B16

https://plugins.svn.wordpress.org/meow-gallery/trunk/readme.txt

Related Vulnerabilities

PostgreSQL Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2019-9193)

WordPress Plugin PickPlugins Product Slider for WooCommerce Unspecified Vulnerability (1.13.23)

OpenSSL Cryptographic Issues Vulnerability (CVE-2015-0204)

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark Cross-Site Scripting (1.7.2)

WordPress Plugin Virtue/Pinnacle ToolKit Unspecified Vulnerability (2.5)

Severity

High

Classification

CVE-2021-24465 CWE-89 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection