CVE-2025-28969
BaseFortify
Publication date: 2025-07-04
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an SQL Injection issue in the WordPress Gallery Widget plugin (up to version 1.2.1). It allows a malicious user with contributor-level privileges to manipulate the database by injecting malicious SQL commands. This can lead to unauthorized access or manipulation of the database. [1]
How can this vulnerability impact me? :
The vulnerability can allow attackers to directly interact with the database, potentially leading to data theft or unauthorized database manipulations. This can compromise the integrity and confidentiality of your data. Since the plugin is abandoned and no official fix exists, the risk remains unless mitigated by removing the plugin or applying a virtual patch. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this SQL Injection vulnerability in the Gallery Widget plugin is challenging because plugin-based malware scanners may be unreliable. There are no specific commands provided for detection. It is recommended to monitor for unusual database interactions or signs of exploitation and consider professional incident response services if compromise is suspected. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include removing and replacing the vulnerable Gallery Widget plugin with an alternative plugin. Since no official fix or updated version is available, applying a virtual patch (vPatch) from Patchstack is recommended to automatically mitigate the vulnerability. Simply deactivating the plugin does not eliminate the risk. [1]