CVE-2017-1002028

Critical

Published: 14/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The WordPress plugin wordpress-gallery-transformation version 1.0 has a SQL injection vulnerability. The issue is in gallery.php, where the $jpic parameter is not properly sanitized before being used in an SQL query.

Risk Assessment

An attacker could exploit this vulnerability to execute unauthorized queries against the database, potentially leading to the disclosure of sensitive information or data manipulation.

Recommendation

It is recommended to update the plugin to the latest version that fixes this vulnerability and to implement additional security measures such as input validation and sanitization.

Original NVD description (English source)

Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query.