CVE-2024-10247 – This vulnerability allows authenticated attacke... (How to Fix)

Q: What is the severity of CVE-2024-10247?

CVE-2024-10247 has a CVSS score of 7.2 (HIGH). This vulnerability allows authenticated attackers with Administrator-level access in WordPress to perform time-based SQL injection attacks via the orderby parameter in the Video Gallery plugin. Attackers can extract sensitive information from the database by appending malicious SQL queries. Only WordPress sites using vulnerable versions of this specific plugin are affected.

📋 TL;DR

This vulnerability allows authenticated attackers with Administrator-level access in WordPress to perform time-based SQL injection attacks via the orderby parameter in the Video Gallery plugin. Attackers can extract sensitive information from the database by appending malicious SQL queries. Only WordPress sites using vulnerable versions of this specific plugin are affected.

💻 Affected Systems

Products:

Video Gallery – Best WordPress YouTube Gallery Plugin

Versions: All versions up to and including 2.4.2

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with the vulnerable plugin activated and an authenticated administrator account.

📦 What is this software?

Video Gallery by Total Soft

View all CVEs affecting Video Gallery →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including extraction of sensitive user data, passwords, and potentially full site takeover if other vulnerabilities are chained.

🟠

Likely Case

Extraction of sensitive plugin data, user information, and potential privilege escalation through data manipulation.

🟢

If Mitigated

Limited impact due to administrator-only access requirement and proper network segmentation.

🌐 Internet-Facing: MEDIUM - Requires authenticated admin access but affects internet-facing WordPress sites.

🏢 Internal Only: LOW - Requires authenticated admin access which should be limited internally.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit requires administrator credentials but the SQL injection technique is well-documented and simple to execute.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after 2.4.2

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3200979/gallery-videos/trunk/admin/class-tsvg-list.php

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Video Gallery – Best WordPress YouTube Gallery Plugin'. 4. Click 'Update Now' if available. 5. If no update appears, manually download latest version from WordPress repository and replace plugin files.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily disable the plugin until patched

wp plugin deactivate gallery-videos

Restrict admin access

all

Limit administrator accounts and implement strong authentication

🧯 If You Can't Patch

Implement web application firewall (WAF) rules to block SQL injection patterns
Restrict plugin functionality to trusted administrators only and monitor admin account activity

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Video Gallery plugin version. If version is 2.4.2 or lower, you are vulnerable.

Check Version:

wp plugin get gallery-videos --field=version

Verify Fix Applied:

Verify plugin version is higher than 2.4.2 and check the class-tsvg-list.php file for proper parameter escaping in the orderby parameter handling.

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in WordPress debug logs
Multiple failed login attempts followed by admin access
Long response times from plugin endpoints suggesting time-based injection

Network Indicators:

Repeated POST requests to plugin admin endpoints with SQL-like parameters
Unusual database connection patterns from web server

SIEM Query:

source="wordpress.log" AND "orderby" AND ("SLEEP" OR "BENCHMARK" OR "WAITFOR")

📊 Metadata

CVE ID: CVE-2024-10247

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: December 6, 2024

Last Updated: July 9, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-10247, you might also want to check these: