CVE-2021-24139
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands on WordPress sites using the Photo Gallery plugin. It affects all WordPress installations with the 10Web Photo Gallery plugin versions before 1.5.55. Attackers can exploit this without authentication via the frontend interface.
💻 Affected Systems
- WordPress 10Web Photo Gallery Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, and full site takeover
Likely Case
Data extraction from WordPress database including user credentials, sensitive content, and configuration data
If Mitigated
Limited impact with proper input validation and database permissions in place
🎯 Exploit Status
SQL injection via bwg_search_x parameter requires minimal technical skill to exploit
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.55
Vendor Advisory: https://wordpress.org/plugins/photo-gallery/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins > Installed Plugins
3. Find 'Photo Gallery by 10Web'
4. Click 'Update Now' if available
5. Alternatively, download version 1.5.55+ from WordPress repository
6. Deactivate and delete old version, then install new version
🔧 Temporary Workarounds
Input Validation Web Application Firewall Rule
allBlock requests containing SQL injection patterns in bwg_search_x parameter
WAF rule: Block if ARGS:bwg_search_x contains SQL keywords like UNION, SELECT, INSERT, DELETE, DROP
Plugin Deactivation
linuxTemporarily disable the vulnerable plugin until patched
wp plugin deactivate photo-gallery
🧯 If You Can't Patch
- Implement strict input validation for all user-supplied parameters
- Restrict database user permissions to minimum required privileges
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins > Installed PluginsCheck Version:
wp plugin get photo-gallery --field=versionVerify Fix Applied:
Confirm plugin version is 1.5.55 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests with bwg_search_x parameter containing SQL syntax
Network Indicators:
- HTTP POST requests to */wp-content/plugins/photo-gallery/frontend/models/model.php with suspicious bwg_search_x values
SIEM Query:
source="web_logs" AND uri="*model.php" AND query="*bwg_search_x*" AND (query="*UNION*" OR query="*SELECT*" OR query="*INSERT*")