CVE-2019-16119

Vulnerability

The Photo Gallery plugin by 10Web for WordPress versions before 1.5.35 suffers from a SQL injection vulnerability. The issue resides in the admin/controllers/Albumsgalleries.php file, where the album_id parameter is directly passed to database queries without proper sanitization [2][3]. The vulnerability is reachable via the admin panel, requiring the attacker to have administrative credentials.

Exploitation

An attacker with WordPress admin privileges can exploit this by sending a crafted request to the admin AJAX endpoint, manipulating the album_id parameter to inject malicious SQL commands. The attack does not require any special network access beyond being logged in as an admin [2].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the WordPress database. This could result in full site compromise, including user credential theft and malicious content injection [2].

Mitigation

The vulnerability is fixed in version 1.5.35 of the plugin [1]. Users are strongly advised to update to the latest version immediately. As of the publication date, no workaround is available without applying the patch [3].