Executive brief
Apptha Slider Gallery, a WordPress plugin used for displaying image slideshows, contains a security flaw that allows unauthorized individuals to access the website's database. By sending a specially crafted web request, an attacker can steal sensitive information such as user credentials and administrative login hashes. This could lead to a full takeover of the website and the exposure of private customer or user data.
Technical details
An SQL injection vulnerability exists in Apptha Slider Gallery 1.0 due to improper neutralization of special elements in the 'albid' parameter. The flaw is reachable via unauthenticated GET requests, allowing a remote attacker to inject malicious SQL payloads. Successful exploitation enables the attacker to perform arbitrary database queries, which can result in the extraction of sensitive data such as WordPress user tables, login names, and password hashes. The vulnerability is confirmed via public exploit code (EDB-41567) utilizing UNION-based SQL injection techniques.
Affected products
- Apptha Slider Gallery 1.0
Timeline
- 2017-03-09: disclosed: Initial exploit published on Exploit-DB
- 2026-06-09: advisory: CVE published/updated in NVD via VulnCheck enrichment