CVE-2024-35750: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2024-35750) affects wpdevart Responsive Image Gallery, Gallery Album plugin for WordPress versions through 2.0.3. It is classified as an SQL Injection vulnerability that allows authenticated users with Contributor-level access or higher to manipulate database queries (Patchstack, WPScan).

The vulnerability is caused by insufficient escaping of user-supplied parameters and lack of proper preparation in existing SQL queries. The CVSS v3.1 base score is 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H according to NVD, while Patchstack rates it at 8.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L (NVD).

The vulnerability allows authenticated attackers with Contributor-level access or higher to append additional SQL queries to existing queries, potentially leading to extraction of sensitive information from the database (WPScan).

The vulnerability requires authentication with at least Contributor-level access to exploit. The attack can be executed remotely through manipulation of SQL queries (Patchstack).

Currently, there is no official fix available for this vulnerability. Patchstack has issued a virtual patch to mitigate the issue by blocking potential attacks until an official fix becomes available (Patchstack).