CVE-2017-12977: SQL Injection
The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwgedittag() in photo-gallery.php and edittag() in admin/controllers/BWGControllerTagsbwg.php. It is exploitable by administrators via the tagid parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12977?
The severity of CVE-2017-12977 is considered high due to its SQL injection potential.
How do I fix CVE-2017-12977?
To fix CVE-2017-12977, upgrade the "Photo Gallery by WD - Responsive Photo Gallery" plugin to version 1.3.51 or later.
Who is affected by CVE-2017-12977?
Administrators using versions of the "Photo Gallery by WD" plugin prior to 1.3.51 are affected by CVE-2017-12977.
What types of attacks can CVE-2017-12977 enable?
CVE-2017-12977 can enable attackers to execute arbitrary SQL queries, potentially compromising the database.
Is CVE-2017-12977 a remote or local vulnerability?
CVE-2017-12977 is a local vulnerability that requires administrative access to exploit.