10Web Photo Gallery < 1.5.55 - SQL Injection
WordPress plugin 10Web Photo Gallery versions before 1.5.55 contains a SQL injection caused by unvalidated input in the 'bwg_search_x' parameter in frontend/models/model.php, letting attackers execute arbitrary SQL commands, exploit requires attacker to control the 'bwg_search_x' parameter. References: https://wpscan.com/vulnerability/2e33088e-7b93-44af-aa6a-e5d924f86e28 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/photo-gallery/photo-gallery-by-10web-1554-sql-injection-via-bwg-search-x-parameter https://nvd.nist.gov/vuln/detail/CVE-2021-24139 Remediation: Update to version 1.5.55 or later.
10 assets checked · domain, subdomain, ipv4