What is CVE-2026-2497?
The Gallery by BestWebSoft plugin for WordPress up to version 4.7.9 is vulnerable to SQL Injection via the '_gallery_order_{post_id}' parameter array keys due to insufficient escaping and lack of query preparation. Users should update the plugin immediately to mitigate this vulnerability.
Azərbaycanca: WordPress üçün Gallery by BestWebSoft pluginin 4.7.9 daxil olmaqla bütün versiyalarında '_gallery_order_{post_id}' parametr massiv açarları vasitəsilə SQL Injection zəifliyi aşkarlanıb. Bu, istifadəçi tərəfindən verilən parametrin düzgün escape edilməməsi və SQL sorğusunun yetərli hazırlanmaması səbəbindən baş verir. Plugin dərhal ən son versiyaya yenilənməlidir.
Related CVEs
link basis: same weakness class CWE-89
FAQ2
Which versions of the Gallery by BestWebSoft plugin are affected by CVE-2026-2497?
This vulnerability affects all versions of the Gallery by BestWebSoft plugin up to and including version 4.7.9.
What should I do to protect against CVE-2026-2497?
Users should update the plugin immediately to the latest version.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.