CVE-2026-39574: Critical SQL Injection in InPost Gallery WordPress Plugin

Overview

CVE-2026-39574 is a critical unauthenticated SQL injection vulnerability affecting the InPost Gallery plugin for WordPress. All versions up to and including 2.1.4.6 are vulnerable. The flaw carries a CVSS score of 9.3 (Critical), reflecting the ability for unauthenticated attackers to extract or manipulate database contents without any prior credentials.

Technical Details

The vulnerability exists in InPost Gallery's gallery retrieval functionality, where user-supplied parameters are incorporated into SQL queries without adequate sanitization or parameterized query handling. An attacker can craft a malicious HTTP request to inject arbitrary SQL commands into the backend database query.

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality / Integrity / Availability: High / High / None

Because no authentication is required and the attack complexity is low, this vulnerability is trivially exploitable by any remote attacker who can reach the WordPress installation.

Impact

Successful exploitation allows an attacker to:

• Extract usernames, hashed passwords, email addresses, and other user data from the wp_users table
• Read plugin configuration data and site secrets stored in the database
• In some server configurations, read arbitrary files via LOAD_FILE() or write web shells using INTO OUTFILE
• Pivot to further compromise the WordPress installation or underlying server

Affected Versions

Remediation

1. Update immediately to the latest version of InPost Gallery from the WordPress Plugin Repository, which includes a patched release addressing this vulnerability.
2. If an immediate update is not possible, disable the plugin until a patch can be applied.
3. Review your database logs and WordPress access logs for signs of exploitation (unusual SELECT, UNION, or encoded payloads in query parameters).
4. Consider deploying a Web Application Firewall (WAF) rule to detect and block SQL injection attempts targeting WordPress plugin endpoints.

Detection

Look for anomalous requests targeting InPost Gallery endpoints with SQL keywords (UNION, SELECT, --, ', etc.) in query strings or POST bodies. Tools such as Wordfence or similar WordPress security plugins may flag suspicious traffic patterns.

References

• NVD Entry for CVE-2026-39574
• WordPress Plugin Repository — InPost Gallery