CVE-2024-35750 Overview
CVE-2024-35750 is a SQL injection vulnerability in the wpdevart Responsive Image Gallery, Gallery Album plugin for WordPress. The flaw affects all plugin versions up to and including 2.0.3. Authenticated attackers with low privileges can inject crafted SQL statements through unsanitized input handled by the plugin. Successful exploitation grants read, write, and disruption capabilities against the underlying WordPress database. The issue is tracked under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.
Critical Impact
Authenticated attackers can execute arbitrary SQL against the WordPress database, leading to credential theft, content tampering, and site takeover.
Affected Products
- wpdevart Responsive Image Gallery, Gallery Album plugin for WordPress
- All versions from initial release through 2.0.3
- WordPress sites with the vulnerable plugin activated
Discovery Timeline
- 2024-06-08 - CVE-2024-35750 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-35750
Vulnerability Analysis
The vulnerability resides in the wpdevart gallery plugin's handling of user-supplied parameters that are concatenated into SQL statements. The plugin fails to neutralize special characters such as single quotes, comments, and UNION keywords before passing the values to the WordPress database layer. An authenticated attacker can inject additional SQL clauses to extract data from arbitrary tables, including wp_users and wp_usermeta. Because the injection executes with the WordPress database user's privileges, attackers can read password hashes, session tokens, and API secrets stored elsewhere in the schema.
Root Cause
The root cause is missing parameterization. The plugin builds queries via string concatenation instead of using $wpdb->prepare() with placeholders. Input passing through gallery or album handlers is not sanitized with esc_sql(), absint(), or equivalent WordPress helpers before reaching the query. This pattern maps directly to [CWE-89].
Attack Vector
Exploitation requires network access to the WordPress site and authenticated access at a low privilege level. No user interaction is required beyond the attacker's own authenticated session. Attackers submit crafted parameter values to a plugin endpoint that reaches the vulnerable query. Time-based, error-based, or UNION-based SQL injection techniques are all viable because the query executes server-side with database-user privileges. See the Patchstack SQL Injection Vulnerability advisory for advisory-level detail.
No verified proof-of-concept code has been published. Technical exploitation details are described in prose only.
Detection Methods for CVE-2024-35750
Indicators of Compromise
- Web server access logs containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP( in parameters targeting /wp-admin/admin-ajax.php or plugin endpoints under /wp-content/plugins/gallery-album/.
- Unexpected database errors in debug.log referencing plugin queries.
- New or modified rows in wp_users with elevated wp_capabilities, indicating post-exploitation account creation.
Detection Strategies
- Enable WordPress query logging or a database audit plugin and alert on statements that reference plugin tables together with UNION, INFORMATION_SCHEMA, or nested SELECT clauses.
- Deploy a web application firewall rule set with signatures for SQL injection targeting authenticated WordPress endpoints.
- Baseline normal parameter values for gallery endpoints and flag deviations in length, character class, or encoding.
Monitoring Recommendations
- Forward WordPress, PHP-FPM, and web server logs to a central analytics platform and correlate authentication events with anomalous query patterns.
- Monitor for outbound connections from the web host to unfamiliar destinations, which can indicate data exfiltration following successful injection.
- Track plugin file integrity and admin user creation events to identify persistence attempts.
How to Mitigate CVE-2024-35750
Immediate Actions Required
- Update the wpdevart Responsive Image Gallery, Gallery Album plugin to a version later than 2.0.3 as soon as the vendor releases a fixed build.
- Rotate WordPress administrator passwords and any secrets accessible from the database, including API keys stored in wp_options.
- Audit wp_users and wp_usermeta for unauthorized accounts or role changes.
Patch Information
At the time of publication, the Patchstack SQL Injection Vulnerability advisory identifies all versions through 2.0.3 as affected. Administrators should verify the installed plugin version against the vendor's latest release and apply updates via the WordPress admin dashboard or WP-CLI.
Workarounds
- Deactivate and remove the plugin until a patched release is confirmed.
- Restrict access to WordPress authenticated endpoints via IP allowlisting or reverse-proxy authentication.
- Enforce least-privilege on the database account used by WordPress, limiting FILE and cross-schema privileges.
# Configuration example: disable the plugin via WP-CLI until patched
wp plugin deactivate gallery-album
wp plugin delete gallery-album
# Verify no residual files remain
ls -la wp-content/plugins/ | grep gallery-album
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
