Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-24139: Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.

CVE-2021-24139 · published 5 years ago

Summary

Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.

What to do

Update 10web photo_gallery to version 1.5.55 or later.

Affected software

Vendor	Product	Affected versions
10web	photo_gallery	< 1.5.55 `cpe:2.3:a:10web:photo_gallery::::::wordpress::*`

Original advisory text

Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.

References

https://wpscan.com/vulnerability/2e33088e-7b93-44af-aa6a-e5d924f86e28 Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

6% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published18 Mar 2021

Updated22 Oct 2026

First seen29 Sep 2026

Sources

CVE-2021-24139 · NVD

Track software like this

Free during beta