CVE-2026-39574: WordPress InPost Gallery plugin <= 2.1.4.6 - SQL Injection vulnerability

Synopsis

This is an unauthenticated SQL injection vulnerability in the InPost Gallery WordPress plugin, affecting all versions up to and including 2.1.4.6. The flaw is reachable over the network with no authentication required and no user interaction needed, meaning any remote party can send a crafted HTTP request to a vulnerable WordPress installation. Successful exploitation allows an attacker to read data from the underlying database and cause limited disruption to availability. HarborGuard is tracking the advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the target WordPress installation.

• AuthenticationNot required

  No account or credentials of any kind are needed; the injection is reachable by any unauthenticated HTTP request.

• Victim interactionNot required

  The attacker does not need any victim to click a link or take any action; the exploit is fully self-contained in the attacker's request.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race windows, or environmental factors to succeed.

Blast Radius

• Reads arbitrary rows from the WordPress database, including user credentials (hashed passwords), email addresses, session tokens, and any plugin or site configuration data stored in the database.
• Does not allow an attacker to write or modify database rows based on the integrity impact rating of None in the CVSS vector.
• Causes limited disruption to availability, consistent with the Low availability impact rating, such as degraded query performance or partial denial of service under sustained exploitation.
• Because the scope token is Changed (S:C), impact can extend beyond the WordPress application itself to other components sharing the same database server, such as other sites on a shared MySQL instance.