CVE-2024-51570: Easy Gallery SQL Injection Vulnerability

CVE-2024-51570 Overview

CVE-2024-51570 is a SQL Injection vulnerability in the odihost Easy Gallery WordPress plugin (simple-gallery-odihost). The flaw stems from improper neutralization of special elements in SQL commands [CWE-89]. All plugin versions up to and including 1.4 are affected.

An authenticated attacker with low privileges can inject malicious SQL statements through vulnerable input handling. The scope-changing nature of the flaw allows the attacker to reach data beyond the plugin's own boundary. Successful exploitation exposes confidential database contents and can degrade availability of the WordPress site.

Critical Impact
Authenticated attackers can extract sensitive WordPress database contents and impact site availability through crafted SQL payloads.

Affected Products

odihost Easy Gallery WordPress plugin (simple-gallery-odihost) versions up to and including 1.4
WordPress installations using the affected plugin as a gallery component
Any site exposing plugin functionality to authenticated low-privileged users

Discovery Timeline

2024-11-09 - CVE-2024-51570 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51570

Vulnerability Analysis

The vulnerability is a classic SQL Injection flaw [CWE-89] within the Easy Gallery plugin's request handling logic. User-supplied input reaches SQL query construction without adequate escaping or parameterization. The scope change indicates the injected query can access resources outside the plugin's authorization boundary.

The attack requires network access and low-privileged authentication. No user interaction is needed to trigger the flaw. Exploitation yields high confidentiality impact against database contents and low availability impact against the affected WordPress instance.

For authoritative technical details, see the Patchstack advisory for the Easy Gallery plugin.

Root Cause

The root cause is unsafe concatenation of tainted input into SQL queries. The plugin does not use the WordPress $wpdb->prepare() API with proper placeholders, nor does it apply strict type-casting or esc_sql() sanitization on parameters used in query construction.

Attack Vector

An authenticated attacker with subscriber-level or higher access sends crafted HTTP requests containing SQL metacharacters to plugin endpoints. The injected payload alters the underlying query structure, allowing UNION-based, boolean-based, or time-based extraction of arbitrary database data. Because the vulnerability is exploitable over the network with low attack complexity, mass exploitation against Internet-exposed WordPress sites is feasible.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in the referenced Patchstack advisory linked above.

Detection Methods for CVE-2024-51570

Indicators of Compromise

HTTP requests to WordPress endpoints referencing the simple-gallery-odihost plugin containing SQL metacharacters such as UNION SELECT, SLEEP(, --, or information_schema
Unexpected wp_users, wp_options, or wp_usermeta read patterns in database query logs
Anomalous response time spikes on plugin request paths, consistent with time-based blind SQL injection
New or modified administrator accounts created shortly after suspicious plugin requests

Detection Strategies

Enable WordPress query logging and inspect queries originating from the Easy Gallery plugin handlers for unusual WHERE, ORDER BY, or UNION clauses
Deploy a Web Application Firewall (WAF) with SQL injection signature detection in blocking mode for /wp-admin/ and plugin AJAX endpoints
Correlate authenticated session activity with database error rates to surface injection probing

Monitoring Recommendations

Alert on repeated HTTP 500 responses from plugin endpoints, which often accompany injection attempts
Baseline normal query patterns for the plugin and flag deviations in query length or column count
Monitor privilege changes in wp_usermeta and outbound egress from the web server to detect data exfiltration

How to Mitigate CVE-2024-51570

Immediate Actions Required

Deactivate and remove the Easy Gallery plugin (simple-gallery-odihost) until a patched version is confirmed available
Rotate all WordPress administrator, database, and API credentials that may have been exposed
Audit the wp_users table for unauthorized accounts and remove any suspicious entries
Review recent posts, options, and uploaded files for evidence of tampering

Patch Information

At the time of the referenced advisory, no fixed version beyond 1.4 was identified. Consult the Patchstack advisory and the WordPress plugin repository for the latest release status before reinstalling.

Workarounds

Restrict access to WordPress authenticated endpoints using IP allow-lists or VPN
Enforce a WAF rule set that blocks common SQL injection payloads targeting the plugin's request parameters
Apply the principle of least privilege to the WordPress database user, removing FILE, CREATE, and DROP permissions where not required
Replace the plugin with a maintained alternative if a patch is not released promptly

bash

# Configuration example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate simple-gallery-odihost
wp plugin delete simple-gallery-odihost

# Restrict database user privileges (MySQL)
REVOKE FILE, CREATE, DROP ON *.* FROM 'wp_user'@'localhost';
FLUSH PRIVILEGES;