SQL Injection in The Gallery by BestWebSoft WordPress Plugin

The Gallery by BestWebSoft plugin for WordPress, in all versions up to and including 4.7.9, contains a high-severity SQL injection vulnerability identified as CVE-2026-2497. The issue resides within the gllr_save_postdata() function, which fails to adequately sanitize or escape user-supplied array keys from the $_POST parameter _gallery_order_{post_id} before processing them in SQL queries.

Because the application fails to utilize prepared statements, an authenticated attacker with Editor-level permissions or higher can inject arbitrary SQL commands. Successful exploitation allows for unauthorized database queries, potentially leading to the extraction of sensitive information stored within the WordPress database. This vulnerability highlights the risks associated with improper handling of user-controllable input in plugin metadata save routines.

Impact

Authenticated attackers holding Editor-level privileges can leverage this vulnerability to gain unauthorized access to site data. This could result in the exfiltration of sensitive configuration details, user account information, or other confidential content stored within the database. Given the nature of WordPress plugins, successful exploitation poses a significant risk to site confidentiality and data integrity.

Recommendation

Prioritized actions for security and IT operations teams:

• Update The Gallery by BestWebSoft plugin to the latest version immediately to remediate CVE-2026-2497.
• Audit WordPress user accounts to ensure that only trusted users are granted Editor-level or higher permissions, as this vulnerability requires elevated access.
• Monitor web server logs for suspicious POST requests targeting gallery-related endpoints that include unexpected SQL syntax (e.g., SELECT, UNION, or comments) within the _gallery_order_ parameter.