The WP Easy Gallery plugin for WordPress, up to version 4.8.5, contains a critical SQL Injection vulnerability identified as CVE-2024-9018. This vulnerability arises from improper neutralization of special elements in SQL commands (CWE-89), specifically due to insufficient escaping and lack of prepared statements for the 'key' parameter. Authenticated attackers with at least Contributor-level privileges can exploit this flaw by injecting malicious SQL payloads via the 'key' parameter, which is incorporated into database queries without adequate sanitization. The attack is time-based, allowing attackers to infer data by measuring response delays, thereby extracting sensitive information from the backend database. The vulnerability affects all versions of the plugin up to 4.8.5 and does not require user interaction beyond authentication. The CVSS v3.1 score is 8.8, reflecting high impact on confidentiality, integrity, and availability, with low attack complexity and no user interaction needed. Although no public exploits are reported yet, the vulnerability's nature and ease of exploitation make it a significant threat to WordPress sites using this plugin.

Exploitation of CVE-2024-9018 can lead to unauthorized disclosure of sensitive data stored in the WordPress database, including user credentials, personal information, and site configuration details. Attackers can manipulate database queries to alter or delete data, compromising data integrity and potentially causing denial of service or site malfunction. Since the vulnerability requires only Contributor-level access, attackers can leverage compromised or weak user accounts to escalate their impact. The widespread use of WordPress and the popularity of gallery plugins increase the potential attack surface globally. Successful exploitation could result in data breaches, reputational damage, regulatory penalties, and operational disruption for affected organizations.

Organizations should immediately update the WP Easy Gallery plugin to a patched version once available. In the absence of a patch, restrict Contributor-level and higher privileges to trusted users only and monitor user activities for suspicious behavior. Implement Web Application Firewalls (WAFs) with rules targeting SQL Injection patterns, especially on the 'key' parameter. Employ database query logging and anomaly detection to identify unusual query patterns indicative of exploitation attempts. Consider disabling or removing the plugin if it is not essential. Additionally, enforce strong authentication policies and regularly audit user permissions to minimize the risk of privilege abuse. Developers should refactor the plugin code to use parameterized queries or prepared statements to prevent injection vulnerabilities.