WordPress Plugin Vulnerabilities

Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection

Description

The plugin does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection

Proof of Concept

Affects Plugins

Plugin icon
photo-gallery
Fixed in 1.6.0

References

CVE
CVE-2022-0169
URL
https://plugins.trac.wordpress.org/changeset/2672822/photo-gallery#file9

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Original Researcher
Krzysztof Zając
Submitter
Krzysztof Zając
Submitter website
https://kazet.cc/
Verified
Yes
WPVDB ID
0b4d870f-eab8-4544-91f8-9c5f0538709c

Timeline

Publicly Published
2022-02-15 (about 3 years ago)
Added
2022-02-15 (about 3 years ago)
Last Updated
2022-04-08 (about 3 years ago)

Other

Published
Title
Published
2015-03-16
Title
Pods 1.4.7 <= 2.5.1.1 - Blind SQL Injection
Published
2014-08-01
Title
WP-SpamFree 3.2.1 - Spam SQL Injection
Published
2023-04-24
Title
WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi
Published
2025-03-27
Title
SEO Plugin by Squirrly SEO < 12.4.06 - Authenticated (Contributor+) SQL Injection
Published
2025-08-26
Title
Advance Seat Reservation Management for WooCommerce <= 3.1 - Unauthenticated SQL Injection