CVE-2017-20247 WordPress Plugin PICA Photo Gallery 1.0 SQL Injection

HighCVSS 8.8 EPSS 0.26%

Published: 2026-06-09 14:48
Updated: 2026-07-29 19:54
Exploit status: No public exploit known

Description

WordPress Plugin PICA Photo Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the aid parameter. Attackers can send GET requests with crafted SQL payloads in the aid parameter to extract sensitive database information including user credentials and table contents.

Affected products

Product	Affected versions	Fixed in
wordpress pica-photo-gallery(WordPress)	<= 1.0	No fix listed
apptha PICA Photo Gallery	= 1.0	No fix listed

References

Wordfence Intelligence third-party-advisory
www.cve.org
ExploitDB-41569 exploit
Official Product Homepage product
VulnCheck Advisory: WordPress Plugin PICA Photo Gallery 1.0 SQL Injection third-party-advisory

CVSS v4.0

8.8 High

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: Low
Vulnerable System Availability: None
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (5)

v4.0 8.8 · vulncheck
v4.0 8.8 · disclosure@vulncheck.com
v3.1 8.2 · vulncheck
v3.1 9.8 · wordfence
v3.1 8.2 · disclosure@vulncheck.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.26% (percentile 18.1)
CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.