CVE-2026-96822: Critical Unauthenticated SQL Injection in Books Gallery WordPress Plugin

Summary

CVE-2026-96822 describes a critical unauthenticated SQL injection vulnerability in the Books Gallery WordPress plugin, affecting versions up to and including 4.8.3. The vulnerability carries a CVSS 3.1 base score of 9.3, classified as CRITICAL severity, and allows remote attackers without any authentication to inject malicious SQL payloads into vulnerable query parameters. The flaw stems from improper sanitization and escaping of user-supplied input before it is incorporated into database queries, a classic pattern associated with CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

The vulnerability was documented through the Patchstack vulnerability database, which catalogs WordPress plugin security issues. Because exploitation requires no authentication and the attack vector is network-based with low complexity, the risk profile is exceptionally high for any site running the affected plugin versions. Site administrators running Books Gallery 4.8.3 or earlier should treat remediation as an urgent priority.

Technical Analysis

The Books Gallery plugin is a WordPress extension designed to display book galleries on WordPress sites. According to the NVD description, the plugin contains an unauthenticated SQL injection flaw in versions up to and including 4.8.3. SQL injection vulnerabilities of this class occur when user-controllable input is concatenated directly into SQL query strings without adequate parameterization, sanitization, or escaping.

The CVSS 3.1 vector string for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. Breaking this down provides insight into the severity and exploitability:

• Attack Vector (AV:N) — Network: The vulnerability is exploitable over the network, meaning any remote attacker with access to the target site can attempt exploitation.
• Attack Complexity (AC:L) — Low: Exploitation does not require special conditions or complex preparations, making it accessible to a wide range of attackers.
• Privileges Required (PR:N) — None: No authentication or authorization of any kind is required, which significantly increases the exposure.
• User Interaction (UI:N) — None: Exploitation does not require any action from a legitimate user or administrator.
• Scope (S:C) — Changed: The vulnerability can impact resources beyond the security scope of the vulnerable component, suggesting potential cross-component database access.
• Confidentiality (C:H) — High: There is a total information disclosure, meaning attackers can potentially read sensitive database contents.
• Integrity (I:N) — None: There is no direct impact on integrity according to the scoring, though SQL injection can sometimes be leveraged for data modification depending on database permissions.
• Availability (A:L) — Low: There may be a minor performance impact or reduced availability, though not a complete denial of service.

The combination of no authentication, network attack vector, low complexity, and high confidentiality impact explains the 9.3 CRITICAL rating. The changed scope indicates that exploitation may allow access to data or resources outside the immediate plugin context, potentially exposing other WordPress tables or even other databases on the same server depending on the database user's privileges.

SQL injection vulnerabilities in WordPress plugins typically manifest through AJAX endpoints, REST API routes, or direct page handlers that accept user input and pass it into $wpdb->query(), $wpdb->get_var(), $wpdb->get_results(), or similar methods without using prepared statements. The WordPress database abstraction layer provides $wpdb->prepare() specifically to mitigate these issues, but plugins that fail to use it or that incorrectly concatenate variables remain vulnerable.

In the case of Books Gallery, the unauthenticated nature of the vulnerability means the vulnerable endpoint is accessible to any visitor of the site, not just logged-in users. This is particularly dangerous because it eliminates the need for attacker credentials and allows automated scanning and mass exploitation campaigns to target any exposed WordPress installation running the plugin.

Affected Software and Versions

Based on the NVD data and the Patchstack reference, the following software is affected:

• Product: Books Gallery (WordPress plugin)
• Affected versions: All versions up to and including 4.8.3
• Vulnerability type: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
• Authentication required: None (unauthenticated)

The NVD description explicitly states that the vulnerability affects Books Gallery <= 4.8.3 versions. This means any site running version 4.8.3 or any earlier version is vulnerable. Site operators should verify their installed version through the WordPress admin plugins page or by inspecting the plugin files directly.

The vendor and specific product slug were not detailed in the NVD record beyond the plugin name. The Patchstack reference URL indicates the plugin slug is wp-books-gallery, which corresponds to the WordPress plugin directory identifier.

Impact

The impact of CVE-2026-96822 is severe due to the combination of unauthenticated access and high confidentiality impact. Successful exploitation can lead to several significant consequences:

• Database content disclosure: Attackers can craft SQL injection payloads that extract arbitrary data from the WordPress database, including user credentials (password hashes), email addresses, session tokens, custom post types, and any other stored information.
• User credential theft: WordPress stores user password hashes in the wp_users table. An attacker who can extract these hashes can attempt offline cracking, potentially gaining administrative access to the site.
• PII exposure: Depending on what data the site collects and stores, personally identifiable information of users, customers, or subscribers could be exposed, creating regulatory and compliance implications under frameworks such as GDPR.
• Scope change exploitation: The CVSS scope change (S:C) suggests that exploitation may allow access to resources beyond the plugin's intended database context. This could mean access to other databases on the same MySQL/MariaDB server if the database user has sufficient privileges.
• Availability disruption: The low availability impact indicates that exploitation could cause minor performance degradation, potentially through resource-intensive queries or database load.
• Reconnaissance for further attacks: Extracted database schema and configuration information can be used to plan subsequent attacks, such as identifying plugin configurations, WordPress version details, and other vulnerability targets.

For e-commerce sites, membership sites, or any WordPress installation handling sensitive user data, the confidentiality impact alone represents a critical risk. The unauthenticated nature means attackers do not need to first compromise a user account, making the vulnerability exploitable at scale by automated botnets.

Exploitation Scenario

A realistic exploitation scenario for CVE-2026-96822 follows a typical SQL injection attack pattern against an unauthenticated WordPress plugin endpoint:

1. Reconnaissance: An attacker identifies WordPress sites running the Books Gallery plugin by scanning for characteristic plugin signatures, such as specific URLs, directories like /wp-content/plugins/wp-books-gallery/, or plugin-specific JavaScript and CSS references in page source.
2. Version identification: The attacker determines the installed plugin version, confirming it is 4.8.3 or earlier. This can sometimes be done by examining the plugin's readme file or version metadata.
3. Vulnerable parameter identification: The attacker probes the plugin's accessible endpoints, which may include AJAX actions registered through wp_ajax_nopriv_ hooks (accessible to unauthenticated users) or direct page-rendering endpoints that accept query parameters.
4. Payload injection: The attacker injects SQL injection payloads into the identified vulnerable parameter. Common techniques include UNION-based injection to extract data across query results, boolean-based blind injection to infer data character by character, or time-based blind injection using functions like SLEEP() to confirm vulnerability.
5. Data extraction: Using refined payloads, the attacker systematically extracts database contents, beginning with schema enumeration (table names, column names) and progressing to sensitive data such as user credentials and site configuration.
6. Post-exploitation: With extracted password hashes, the attacker attempts offline cracking. With administrative credentials, the attacker can achieve full site compromise, potentially installing backdoors, modifying content, or using the server for further attacks.

Because the vulnerability is unauthenticated and the attack complexity is low, this scenario can be fully automated. Mass scanning tools can identify vulnerable sites, and exploitation frameworks can automate payload delivery and data extraction across thousands of targets simultaneously.

Detection and Mitigation

Detection

Detecting exploitation of this vulnerability requires monitoring for signs of SQL injection attempts against the Books Gallery plugin endpoints:

• Web application firewall (WAF) logs: Review WAF logs for SQL injection signatures targeting plugin URLs, including UNION SELECT patterns, boolean-based injection strings, and time-based functions like SLEEP() or BENCHMARK().
• Server access logs: Examine web server access logs for unusual requests to plugin endpoints, particularly those containing encoded SQL keywords, single quotes, comment sequences (--, /*), or unexpected parameter values.
• Database query monitoring: Enable MySQL/MariaDB query logging or use database monitoring tools to identify anomalous queries originating from the plugin, especially queries with unexpected UNION clauses, information schema access, or unusually long execution times.
• File integrity monitoring: Watch for unauthorized changes to WordPress core files, plugin files, or theme files that could indicate post-exploitation activity following successful SQL injection.
• User account monitoring: Audit for unexpected new administrator accounts, password changes, or unusual login activity that could indicate credential compromise following data extraction.

Mitigation

The primary mitigation is to update the Books Gallery plugin to a version newer than 4.8.3 if a patched version is available. Site administrators should take the following steps:

• Update the plugin: Check the WordPress plugin directory or the vendor's official source for a patched version. If an update is available, apply it immediately after testing in a staging environment.
• Disable the plugin if no patch exists: If no patched version is available, deactivate and remove the Books Gallery plugin from the site until a fix is released. This eliminates the attack surface entirely.
• Deploy a WAF: Implement a web application firewall with SQL injection detection rules. While WAF rules can provide defense-in-depth, they should not be relied upon as the sole mitigation since determined attackers may bypass them.
• Restrict database privileges: Ensure the WordPress database user has the minimum necessary privileges. While this does not prevent injection, it can limit the damage by restricting access to other databases or preventing certain operations.
• Rotate credentials: If exploitation is suspected, rotate all WordPress user passwords, regenerate authentication keys and salts in wp-config.php, and invalidate active sessions.
• Conduct a security audit: After remediation, perform a thorough security audit of the site, including database integrity checks, file system review, and user account audit to identify any signs of prior compromise.

Bug Bounty Angle

For security researchers and bug bounty hunters, CVE-2026-96822 represents a textbook example of an unauthenticated SQL injection vulnerability in a WordPress plugin. Several aspects make this vulnerability noteworthy from a bug bounty perspective:

• Unauthenticated access: The lack of authentication requirement means the vulnerability is accessible to any external attacker, increasing its severity and bounty value. Unauthenticated vulnerabilities typically command higher payouts than authenticated ones.
• High CVSS score: The 9.3 CRITICAL rating reflects the real-world impact and makes this a high-priority finding for any bounty program that includes the affected plugin in scope.
• CWE-89 classification: SQL injection is a well-understood and widely recognized vulnerability class. Bounty programs typically have clear payout tiers for SQL injection based on impact and authentication requirements.
• Scope change: The S:C scope change in the CVSS vector indicates potential for cross-component impact, which can strengthen the case for higher bounty payouts by demonstrating broader impact.
• Demonstration requirements: When reporting similar vulnerabilities, researchers should provide clear proof of concept demonstrating data extraction without causing harm, such as extracting a non-sensitive test value or demonstrating boolean-based blind injection against a controlled target.

Researchers identifying similar vulnerabilities in WordPress plugins should follow responsible disclosure practices, reporting through appropriate channels such as the Patchstack vulnerability program, WPScan, or direct vendor contact. The Patchstack database, which documented this vulnerability, operates a bug bounty platform specifically for WordPress ecosystem vulnerabilities.

Frequently Asked Questions

What versions of Books Gallery are affected by CVE-2026-96822?

The vulnerability affects all versions of the Books Gallery WordPress plugin up to and including version 4.8.3. Any site running version 4.8.3 or earlier is vulnerable to unauthenticated SQL injection.

Does exploiting this vulnerability require authentication?

No. The vulnerability is explicitly described as unauthenticated, meaning an attacker does not need any WordPress user account or credentials to exploit it. The CVSS vector confirms this with PR:N (Privileges Required: None).

What is the CVSS score for CVE-2026-96822?

The vulnerability has a CVSS 3.1 base score of 9.3, rated CRITICAL. The full vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, indicating network-based, low-complexity, unauthenticated exploitation with high confidentiality impact and changed scope.

References

• NVD - CVE-2026-96822
• Patchstack Vulnerability Database - Books Gallery Plugin 4.8.3 SQL Injection