⛔ Critical Security Advisory Aeroscroll Gallery · WordPress.org · 1.0.13 Disclosed 2026-07-10 · 20:00 UTC
Coordinated disclosure — technical detail withheld until 2026-08-24 (12 days). The affected package, version, vulnerability class and remediation are public on this page so defenders can act now. The exact code location, sink and reproduction are held back to limit exploitation until the window closes, then revealed automatically. Vendor notified 2026-07-10.
Advisory · CLR-2026-3028

Unauthenticated SQL Injection in the WordPress plugin Aeroscroll Gallery (1.0.13)

Aeroscroll Gallery (WordPress.org, version 1.0.13) Aeroscroll Gallery (1.0.13) exposes an unauthenticated WordPress REST route (aeroscroll/v1) whose handler builds a SQL query by string concatenation. A numeric guard is applied to one request parameter, but a second, unguarded parameter is concatenated into the query, so an unauthenticated request can inject SQL and read arbitrary database contents (WordPress user password hashes, secrets). No fixed release is available.

CriticalSQL InjectionUnauthenticatedWordPressVerified in source
Summary

Aeroscroll Gallery 1.0.13 (WordPress.org) contains an unauthenticated sql injection. The plugin registers a handler reachable by visitors who are not logged in, and it concatenates a request parameter straight into a live SQL statement.

The unauthenticated endpoint validates one request parameter with a numeric check, but the SQL query concatenates a different request parameter that is never validated anywhere, so that value reaches the database completely unsanitised. The result is a blind/time-based SQL-injection channel through which the full database (user password hashes, secrets) can be extracted.

Aeroscroll Gallery was surfaced automatically by the codelake WordPress static-analysis pipeline (source-to-sink taint) · AI false-positive triage · manual source verification, and then verified by hand against the shipped 1.0.13 artifact.

Impact

Class: SQL Injection (CWE-89). Privilege required: none — the injectable endpoint is registered for logged-out visitors. Effect: read access to the entire database via blind SQL injection (credential hashes, secrets, tokens); depending on database privileges, write access.

The precise sink locations and code are withheld below until the disclosure deadline.

Vulnerable code
🔒
Technical detail withheld until 2026-08-24 (12 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.
Technical detail
🔒
Technical detail withheld until 2026-08-24 (12 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.
Timeline
2026-07-10
Automatic detection
codelake WordPress static-analysis pipeline (source-to-sink taint) flags a request-to-database taint flow with no prepared statement; AI-triage marks it a real finding.
2026-07-10
Manual verification
Confirmed against the shipped 1.0.13 artifact — unauthenticated reachability verified in source.
2026-07-10
0:00 UTC
WordPress Plugin Security Team notified
Coordinated disclosure opened with full technical detail; a 45-day window begins.
2026-08-24
Technical-detail reveal
The exact code location and reproduction are published automatically after the 45-day window.
Indicators & characteristics
PKGAeroscroll Gallery 1.0.13 (WordPress.org) — wordpress.org/plugins/aeroscroll-gallery
SHA2568e0528f6ab8e94e1b79b0dd5a790d0ed6fa8c5389d86568872e8c0ef8ef03ca2 (artifact)
CLASSCWE-89 SQL Injection · sanitize_text_field() used as an (ineffective) SQL neutraliser
AUTHZNo authentication required · no nonce · no capability check
🔒SINK — withheld until 2026-08-24
🔒ENTRY — withheld until 2026-08-24
Remediation
#ActionPriority
01 Update to a fixed release once the vendor ships one; until then, deactivate Aeroscroll Gallery. Critical
02 Patch: replace every concatenated query with $wpdb->prepare() and typed placeholders (%d/%s). High
03 Add nonce + capability checks (check_ajax_referer(), current_user_can()) to state-changing AJAX handlers and remove any unintended nopriv registration. High
04 Check access logs for requests with SQL metacharacters in parameters during the exposure window. Recommended

Detected by codelake Research · codelake WordPress static-analysis pipeline (source-to-sink taint) · AI false-positive triage · manual source verification · disclosed to WordPress Plugin Security Team before publication.

This is a coordinated vulnerability disclosure. The affected package, version and class are published immediately so defenders can act; the exact code location and reproduction are withheld until the deadline, and no weaponised proof-of-concept is published. The archived artifact is available to verified security researchers on request.