⛔ Critical Security Advisory Aeroscroll Gallery · WordPress.org · 1.0.13 Disclosed 2026-07-10 · 20:00 UTC

Full technical detail published. The 45-day coordinated-disclosure window (vendor notified 2026-07-10) has passed; the exact code location and analysis are shown below. No weaponised exploit is published.

Advisory · CLR-2026-3028

Unauthenticated SQL Injection in the WordPress plugin Aeroscroll Gallery (1.0.13)

Aeroscroll Gallery (WordPress.org, version 1.0.13) Aeroscroll Gallery (1.0.13) exposes an unauthenticated WordPress REST route (aeroscroll/v1) whose handler builds a SQL query by string concatenation. A numeric guard is applied to one request parameter, but a second, unguarded parameter is concatenated into the query, so an unauthenticated request can inject SQL and read arbitrary database contents (WordPress user password hashes, secrets). No fixed release is available.

CriticalSQL InjectionUnauthenticatedWordPressVerified in source

Summary

Aeroscroll Gallery 1.0.13 (WordPress.org) contains an unauthenticated sql injection. The plugin registers a handler reachable by visitors who are not logged in, and it concatenates a request parameter straight into a live SQL statement.

The unauthenticated endpoint validates one request parameter with a numeric check, but the SQL query concatenates a different request parameter that is never validated anywhere, so that value reaches the database completely unsanitised. The result is a blind/time-based SQL-injection channel through which the full database (user password hashes, secrets) can be extracted.

Aeroscroll Gallery was surfaced automatically by the codelake WordPress static-analysis pipeline (source-to-sink taint) · AI false-positive triage · manual source verification, and then verified by hand against the shipped 1.0.13 artifact.

Impact

Class: SQL Injection (CWE-89). Privilege required: none — the injectable endpoint is registered for logged-out visitors. Effect: read access to the entire database via blind SQL injection (credential hashes, secrets, tokens); depending on database privileges, write access.

The precise sink locations and code are withheld below until the disclosure deadline.

Vulnerable code

 aeroscroll-gallery/includes/class-aeroscroll-gallery-custom-endpoint.php ⛔ unauthenticated sql injection 
37register_rest_route('aeroscroll/v1', '/getimagegallerydata', [
40  'permission_callback' => '__return_true'   // unauthenticated
1546$galleryid = $request->get_param('gallery_id'); // attacker-controlled, never validated
1577if ($imagegalleryid != -1 && is_numeric($imagegalleryid)) {   // guards the WRONG parameter
1585  $query = "SELECT * FROM $table_gallery WHERE id = ".$galleryid; // gallery_id concatenated raw
1586  $results = $wpdb->get_results($query);
  }

Technical detail

Because the action carries the wp_ajax_nopriv_ prefix it is reachable without a session. The tainted value lands in the query with no parameterisation.

Further unparameterised queries: the ORDER BY clause at line 1636 also concatenates request-derived sort parameters; note that the concatenated sink at line 356 (get_posts / gridid) IS guarded by is_numeric() and is not exploitable.

A working proof-of-concept is intentionally not published; the exact reproduction was shared privately with WordPress Plugin Security Team.

Timeline

2026-07-10

Automatic detection

codelake WordPress static-analysis pipeline (source-to-sink taint) flags a request-to-database taint flow with no prepared statement; AI-triage marks it a real finding.

2026-07-10

Manual verification

Confirmed against the shipped 1.0.13 artifact — unauthenticated reachability verified in source.

2026-07-10
0:00 UTC

WordPress Plugin Security Team notified

Coordinated disclosure opened with full technical detail; a 45-day window begins.

2026-08-24

Technical-detail reveal

The exact code location and reproduction are published automatically after the 45-day window.

Indicators & characteristics

PKGAeroscroll Gallery 1.0.13 (WordPress.org) — wordpress.org/plugins/aeroscroll-gallery

SHA2568e0528f6ab8e94e1b79b0dd5a790d0ed6fa8c5389d86568872e8c0ef8ef03ca2 (artifact)

CLASSCWE-89 SQL Injection · sanitize_text_field() used as an (ineffective) SQL neutraliser

AUTHZNo authentication required · no nonce · no capability check

SINKexact file:line of the injectable sink

ENTRYexact endpoint / action name

Remediation

#	Action	Priority
01	Update to a fixed release once the vendor ships one; until then, deactivate Aeroscroll Gallery.	Critical
02	Patch: replace every concatenated query with `$wpdb->prepare()` and typed placeholders (`%d`/`%s`).	High
03	Add nonce + capability checks (`check_ajax_referer()`, `current_user_can()`) to state-changing AJAX handlers and remove any unintended `nopriv` registration.	High
04	Check access logs for requests with SQL metacharacters in parameters during the exposure window.	Recommended

Detected by codelake Research · codelake WordPress static-analysis pipeline (source-to-sink taint) · AI false-positive triage · manual source verification · disclosed to WordPress Plugin Security Team before publication.

This is a coordinated vulnerability disclosure. The affected package, version and class are published immediately so defenders can act; the exact code location and reproduction are withheld until the deadline, and no weaponised proof-of-concept is published. The archived artifact is available to verified security researchers on request.