CVE-2026-39574: InPost Gallery SQLi Vulnerability

CVE-2026-39574 Overview

CVE-2026-39574 is an unauthenticated SQL injection vulnerability affecting the InPost Gallery WordPress plugin in versions up to and including 2.1.4.6. The flaw is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. Remote attackers can inject malicious SQL statements without authentication, allowing them to query the WordPress backend database. The vulnerability was published to the National Vulnerability Database (NVD) on June 16, 2026, based on a security report from Patchstack.

Critical Impact
Unauthenticated attackers can send crafted HTTP requests to extract sensitive data from the WordPress database, including user credentials and configuration secrets.

Affected Products

InPost Gallery WordPress plugin versions <= 2.1.4.6
WordPress sites running the vulnerable plugin in any deployment configuration
Hosting environments that expose the plugin endpoints to the public internet

Discovery Timeline

2026-06-16 - CVE-2026-39574 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-39574

Vulnerability Analysis

The vulnerability stems from unsanitized user-supplied input being concatenated directly into SQL queries executed by the InPost Gallery plugin. Because the affected endpoints do not require authentication, any remote actor can reach the injection point over the network. The attack complexity is low and requires no user interaction, making opportunistic exploitation against exposed WordPress installations practical. The CWE-89 classification indicates the plugin fails to apply parameterized queries or proper input escaping before passing data to the database layer.

Root Cause

The root cause is improper neutralization of special characters in SQL statements within the InPost Gallery plugin code. Input parameters delivered through HTTP requests are interpolated into query strings without using prepared statements or the WordPress $wpdb->prepare() API. This allows attacker-controlled SQL syntax to alter query logic and read arbitrary database rows.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends crafted HTTP requests containing SQL payloads in vulnerable parameters processed by the plugin. The scope is changed, meaning the impact extends beyond the vulnerable component to the underlying WordPress database. Successful exploitation yields high confidentiality impact through data exfiltration and limited availability impact through query manipulation. EPSS data published on 2026-06-18 lists the exploitation probability at 0.234%. Refer to the Patchstack Security Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-39574

Indicators of Compromise

Inbound HTTP requests to InPost Gallery plugin endpoints containing SQL metacharacters such as ', UNION, SELECT, SLEEP(, or --
Unexpected database errors or anomalous response times originating from plugin endpoints
Web server access logs showing repeated requests with encoded payloads targeting plugin query parameters

Detection Strategies

Inspect WordPress access logs for requests referencing InPost Gallery handlers with suspicious query string content
Deploy a web application firewall (WAF) rule set configured to identify and block SQL injection patterns against WordPress plugin routes
Correlate database query logs with HTTP request logs to identify injected UNION SELECT or boolean-based payloads

Monitoring Recommendations

Enable verbose logging on the WordPress database to capture query patterns that deviate from normal plugin behavior
Alert on outbound data volumes from the WordPress host that exceed baseline thresholds, indicating possible exfiltration
Monitor file integrity for the wp-content/plugins/inpost-gallery/ directory to detect tampering after suspected exploitation

How to Mitigate CVE-2026-39574

Immediate Actions Required

Identify all WordPress sites running InPost Gallery <= 2.1.4.6 using plugin inventory tooling or the WordPress admin dashboard
Disable or remove the InPost Gallery plugin until a patched version is installed and verified
Restrict access to the WordPress administrative and plugin endpoints behind authentication or IP allowlists where feasible

Patch Information

No patched version is listed in the current advisory data. Site administrators should consult the Patchstack Security Vulnerability Report for the latest remediation guidance and apply any vendor-released update as soon as it becomes available.

Workarounds

Deploy WAF virtual patching rules that block SQL injection signatures against InPost Gallery plugin endpoints
Apply least-privilege principles to the WordPress database user, removing rights not required for normal plugin operation
Rotate WordPress secrets, API keys, and administrative credentials if exploitation is suspected

bash

# Configuration example
# Disable the vulnerable plugin via WP-CLI until a fix is released
wp plugin deactivate inpost-gallery
wp plugin delete inpost-gallery