CVE-2024-8436: WP Easy Gallery Plugin SQLi Vulnerability

CVE-2024-8436 Overview

CVE-2024-8436 is a SQL injection vulnerability in the WP Easy Gallery WordPress plugin developed by plugingarden. The flaw affects all versions up to and including 4.8.5 and stems from insufficient escaping of the edit_imageId and edit_imageDelete parameters combined with improper SQL query preparation. Authenticated attackers with subscriber-level access or higher can append arbitrary SQL statements to existing queries. Successful exploitation allows extraction of sensitive data from the WordPress database, including user credentials and session tokens. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Authenticated attackers with minimal privileges can extract sensitive database contents, including password hashes and personally identifiable information.

Affected Products

• WP Easy Gallery WordPress Plugin versions up to and including 4.8.5
• WordPress sites running the plugingarden wp_easy_gallery plugin
• All WordPress installations where subscriber registration is enabled and the plugin is active

Discovery Timeline

• 2024-09-25 - CVE-2024-8436 published to NVD
• 2025-09-26 - Last updated in NVD database

Technical Details for CVE-2024-8436

Vulnerability Analysis

The vulnerability resides in the WP Easy Gallery plugin's image management functionality. The plugin accepts the edit_imageId and edit_imageDelete parameters from authenticated user requests and concatenates them directly into SQL queries. The plugin neither escapes the input nor uses prepared statements with parameter binding. This allows attackers to terminate the intended query and append additional SQL commands. The attack requires only subscriber-level credentials, which are commonly available on WordPress sites that allow open registration.

Root Cause

The root cause is improper neutralization of user-supplied input in SQL queries [CWE-89]. The plugin code at wp-easy-gallery.php constructs database queries by string concatenation without invoking WordPress's $wpdb->prepare() method or applying esc_sql() escaping. The absence of placeholder-based query construction permits attacker-controlled values to be interpreted as SQL syntax rather than data.

Attack Vector

An authenticated attacker submits a crafted HTTP request to the vulnerable plugin endpoint with malicious SQL payloads in the edit_imageId or edit_imageDelete parameters. The injected SQL executes with the privileges of the WordPress database user, typically permitting reads across the entire WordPress schema. Attackers can use UNION-based or time-based blind injection techniques to exfiltrate data from the wp_users table, including the user_pass column containing password hashes. The network-accessible attack surface, low complexity, and minimal privilege requirements make exploitation straightforward.

Technical details are documented in the WordPress Plugin Code Review and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-8436

Indicators of Compromise

• HTTP requests containing SQL syntax such as UNION SELECT, SLEEP(, or -- in the edit_imageId or edit_imageDelete parameters
• Unusual outbound queries from the WordPress database process or unexpected reads against the wp_users table
• WordPress access logs showing authenticated subscriber accounts accessing plugin admin endpoints
• Newly registered subscriber accounts followed by immediate access to gallery plugin URLs

Detection Strategies

• Inspect WordPress access and error logs for malformed edit_imageId and edit_imageDelete parameter values
• Deploy a web application firewall (WAF) rule that flags SQL metacharacters in plugin parameters
• Enable database query logging and alert on queries referencing sensitive tables originating from gallery plugin code paths

Monitoring Recommendations

• Monitor authentication events for newly created low-privilege accounts performing administrative plugin actions
• Track HTTP response sizes and timing anomalies on plugin endpoints that may indicate blind injection probing
• Alert on outbound data transfers correlated with WordPress database read spikes

How to Mitigate CVE-2024-8436

Immediate Actions Required

• Disable the WP Easy Gallery plugin until a patched version is verified and installed
• Audit WordPress user accounts and remove unrecognized subscriber-level accounts
• Rotate all WordPress administrator passwords and database credentials if exploitation is suspected
• Restrict open user registration on WordPress sites running the affected plugin

Patch Information

No vendor-confirmed patched version is referenced in the CVE record at the time of publication. Administrators should consult the Wordfence Vulnerability Analysis for current patch availability and upgrade to any version released after 4.8.5 that addresses the issue.

Workarounds

• Remove or deactivate the WP Easy Gallery plugin from the WordPress installation
• Block access to plugin endpoints handling edit_imageId and edit_imageDelete parameters at the WAF or reverse proxy layer
• Disable subscriber-level registration to remove the authenticated attack prerequisite
• Enforce least-privilege database accounts that limit the WordPress user's ability to read sensitive tables

# Disable the plugin via WP-CLI
wp plugin deactivate wp-easy-gallery
wp plugin delete wp-easy-gallery

# Block subscriber registration in wp-config.php
update_option('users_can_register', 0);