This vulnerability, identified as CVE-2024-43207, is an SQL Injection issue (CWE-89) in Valiano Unite Gallery Lite versions up to 1.7.62. It arises from improper neutralization of special elements used in SQL commands, enabling attackers with low privileges to potentially execute unauthorized SQL queries. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality (high) and availability (low). No vendor patch or official remediation has been published yet.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information and partial denial of service. The confidentiality impact is high, while integrity is not impacted, and availability impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected component and monitoring for unusual database activity related to the Unite Gallery Lite plugin. Avoid exposing the vulnerable component to untrusted users where possible.