CVE-2026-2024 is an SQL Injection vulnerability in the PhotoStack Gallery WordPress plugin by savitasoni. The issue arises from improper neutralization of special elements in the 'postid' parameter, allowing unauthenticated attackers to append malicious SQL queries. This occurs because the plugin fails to properly escape user input and does not use prepared statements, leading to potential unauthorized data disclosure. The vulnerability affects all versions up to 0.4.1. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive database information. The attacker does not require authentication, increasing the risk. However, there is no indication of impact on data integrity or availability. The CVSS score of 7.5 reflects a high impact on confidentiality with no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the PhotoStack Gallery plugin or restricting access to the vulnerable functionality. Applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'postid' parameter may provide temporary mitigation.