CVE-2016-10940

Vulnerability

The ZM Gallery plugin for WordPress, version 1.0, contains a SQL injection vulnerability in the order parameter. The plugin fails to sanitize user input before using it in a database query, allowing an attacker to inject arbitrary SQL. The vulnerability is present in the plugin's gallery functionality, which is accessible to unauthenticated users. [1] notes that the plugin has been closed and removed from the WordPress.org directory as of October 21, 2015, likely due to this or other issues.

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to a WordPress site running the vulnerable plugin. The order parameter is passed directly into a SQL query without proper sanitization. No authentication is required, as the gallery feature is publicly accessible. The attacker can inject SQL commands by appending malicious payloads to the order parameter, such as order=1 UNION SELECT ....

Impact

Successful exploitation allows an attacker to execute arbitrary SQL queries against the WordPress database. This can lead to data exfiltration (e.g., user credentials, posts), modification of database content, or privilege escalation. In some cases, the attacker may be able to gain administrative access to the WordPress site.

Mitigation

The ZM Gallery plugin has been closed and removed from the WordPress.org plugin directory as of October 21, 2015 [1]. No patched version is available. Users who have this plugin installed should immediately uninstall it and replace it with an alternative gallery plugin. There is no known workaround other than removing the plugin entirely.