Description
SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/72015
Exploit mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2015/Jan/36
Scores
EPSS
0.0213
EPSS Percentile
80.0%
Details
CWE
CWE-89
Status
published
Products (1)
10web/photo_gallery
1.2.7
Published
Jan 16, 2015
Tracked Since
Feb 18, 2026