CVE-2022-1281
Published: 02 May 2022
Summary
CVE-2022-1281 is a critical-severity SQL Injection (CWE-89) vulnerability in 10Web Photo Gallery. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is an SQL injection flaw (CWE-89) in the Photo Gallery WordPress plugin through version 1.6.3. The root cause is insufficient escaping of the $_POST['filter_tag'] parameter before it is concatenated into an SQL query in the frontend gallery handling code.
An unauthenticated remote attacker can supply a crafted filter_tag value in a POST request to trigger arbitrary SQL commands against the backend database. Successful exploitation yields full read, write, and delete access to database contents, consistent with the CVSS 9.8 rating that reflects no required authentication or user interaction and high impact across confidentiality, integrity, and availability.
The referenced WordPress Trac changesets show a fix committed to BWGModelGalleryBox.php that addresses the missing escaping, and the WPScan entry provides additional technical confirmation of the issue.
The EPSS score rose from a low baseline to a peak of 0.2098 on 2025-12-11 before receding to the current value of 0.0601, indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-24612
Vulnerability details
The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.