Executive brief
The Photo Gallery by Ays plugin is a popular WordPress tool for creating and managing responsive image galleries. An authenticated administrator can inject malicious SQL commands through the search parameter to extract sensitive database information, potentially exposing customer data, user credentials, and other confidential information stored in WordPress databases.
Technical details
This is a SQL Injection vulnerability in the gallery-photo-gallery WordPress plugin (versions ≤6.8.2) affecting the 's' parameter due to insufficient input escaping and inadequate SQL query preparation. The vulnerability exists in two code paths: $wpdb->get_var() in record_count() and $wpdb->get_results() in prepare_items()/get_image_categories(). Both blind and UNION-based SQL injection techniques are possible. The attack requires authenticated access with administrator-level privileges or higher, and attackers can extract sensitive data from the WordPress database. A patch should be available in version 6.8.3 or later.
Affected products
- Ays Themes The Photo Gallery by Ays – Responsive Image Gallery up to and including 6.8.2
Timeline
- 2026-09-01: disclosed