WordPress CVEs

Description

A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php.

Affected WordPress components

• Photo Gallery by 10Web – Mobile-Friendly Image Gallery Plugin · photo-gallery
  Possible match Active
  Versions not specified
  View on WordPress.org
• Photo Gallery Theme · photo-gallery
  Possible match Active
  Versions not specified
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• 10web photo_gallery — Before 1.5.31

References

• fortiguard.com https://fortiguard.com/zeroday/FG-VD-19-101 Third Party Advisory
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/2128378 Patch
• wordpress.org https://wordpress.org/plugins/photo-gallery/#developers Release Notes
• wpvulndb.com https://wpvulndb.com/vulnerabilities/9480 Third Party Advisory
• nvd.nist.gov Official NVD record