CVE-2024-55981
Published: 16 December 2024
Summary
CVE-2024-55981 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 3.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2024-55981 is an SQL injection flaw (CWE-89) in the Nabz Image Gallery WordPress plugin by Nabajit Roy. It affects all versions from n/a through 1.00 and arises from improper neutralization of special elements in SQL commands, rated at CVSS 9.3 with network attack vector, low complexity, no authentication or user interaction required, and changed scope.
Unauthenticated remote attackers can supply crafted input to trigger arbitrary SQL queries. This enables high-impact confidentiality breaches such as database extraction, along with limited availability effects that may extend beyond the vulnerable component due to the changed scope.
The vulnerability is documented in the Patchstack database entry for the WordPress Nabz Image Gallery plugin, which serves as the primary advisory reference for affected deployments.
The associated EPSS score stands at 0.2515 with no subsequent rise indicated.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52881
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nabajit Roy Nabz Image Gallery nabz-image-gallery allows SQL Injection.This issue affects Nabz Image Gallery: from n/a through <= v1.00.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.