Vulnerability Description
The get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin before 4.4.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ays-Pro | Photo Gallery | < 4.4.4 |
Related Weaknesses (CWE)
References
- https://wpscan.com/vulnerability/e24dac6d-de48-42c1-bdde-4a45fb331376ExploitThird Party Advisory
- https://wpscan.com/vulnerability/e24dac6d-de48-42c1-bdde-4a45fb331376ExploitThird Party Advisory
FAQ
What is CVE-2021-24462?
CVE-2021-24462 is a vulnerability with a CVSS score of 8.8 (HIGH). The get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin before 4.4.4 did not use whitelist or validate the orderby parameter ...
How severe is CVE-2021-24462?
CVE-2021-24462 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-24462?
Check the references section above for vendor advisories and patch information. Affected products include: Ays-Pro Photo Gallery.