Because the application fails to utilize prepared statements, an authenticated attacker with Editor-level permissions or higher can inject arbitrary SQL commands. Successful exploitation allows for unauthorized database queries, potentially leading to the extraction of sensitive information stored within the WordPress database. This vulnerability highlights the risks associated with improper handling of user-controllable input in plugin metadata save routines.

Impact

Authenticated attackers holding Editor-level privileges can leverage this vulnerability to gain unauthorized access to site data. This could result in the exfiltration of sensitive configuration details, user account information, or other confidential content stored within the database. Given the nature of WordPress plugins, successful exploitation poses a significant risk to site confidentiality and data integrity.

Recommendation

Prioritized actions for security and IT operations teams:

• Update The Gallery by BestWebSoft plugin to the latest version immediately to remediate CVE-2026-2497.
• Audit WordPress user accounts to ensure that only trusted users are granted Editor-level or higher permissions, as this vulnerability requires elevated access.
• Monitor web server logs for suspicious POST requests targeting gallery-related endpoints that include unexpected SQL syntax (e.g., SELECT, UNION, or comments) within the _gallery_order_ parameter.