CVE-2021-24465

HIGH

Meow Gallery < 4.1.9 - Authenticated SQL Injection via Gallery Shortcode ids Attribute

Title source: llm
STIX 2.1

Description

The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode (available for users as low as Contributor) before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned values to be manipulated in a way that could lead to data disclosure and arbitrary objects to be deserialized.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/08dbe202-0136-4502-87e7-5e984dc27b16

Scores

CVSS v3 8.1
EPSS 0.0113
EPSS Percentile 62.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-89
Status published
Products (1)
meowapps/meow_gallery < 4.1.9
Published Oct 04, 2021
Tracked Since Feb 18, 2026