CVE-2024-10247: 
WordPress vulnerability analysis and mitigation

The Video Gallery – Best WordPress YouTube Gallery Plugin for WordPress contains a time-based SQL Injection vulnerability (CVE-2024-10247) in versions up to and including 2.4.2. The vulnerability exists in the orderby parameter due to insufficient escaping of user-supplied input and inadequate SQL query preparation (NVD).

The vulnerability is classified as an SQL Injection (CWE-89) with a CVSS v3.1 Base Score of 7.2 (HIGH) and vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The issue stems from improper handling of the orderby parameter, which allows authenticated users with administrator-level access to append additional SQL queries to existing database queries (NVD).

When exploited, this vulnerability allows authenticated attackers with administrator-level access to extract sensitive information from the database by injecting additional SQL queries into existing database operations (NVD).

The vulnerability requires administrator-level authentication to exploit. While this limits the potential attack surface, it still presents a significant risk as authenticated administrators could potentially access unauthorized database information (NVD).

Users should update to a version newer than 2.4.2 if available. The vulnerability has been identified and documented, suggesting that a patch may be available in newer versions (NVD).