Understanding the Risk: Thumbnail Slider With Lightbox SQL Injection
A security flaw, identified as CVE-2015-10146, has been discovered in the "Thumbnail Slider With Lightbox" plugin for WordPress. This issue, a type of SQL Injection, could allow a malicious actor with administrative privileges to gain unauthorized access to sensitive information stored in your website’s database.
SQL Injection vulnerabilities occur when an application doesn’t properly clean up or "escape" data entered by users before using it in a database query. In this case, the 'id' parameter in the plugin was not handled safely, making it possible for an attacker to insert their own database commands. Since this vulnerability requires administrator-level access, it highlights the importance of strong security practices even for trusted users.
CVE Details
- Product Name: Thumbnail Slider With Lightbox (WordPress Plugin)
- CVE ID: CVE-2015-10146
- Published Date: October 29, 2025
- Severity: Medium
- Status: Analyzed
Affected Products
The "Thumbnail Slider With Lightbox" plugin, also known as "WP Responsive Slider With Lightbox," is affected by this SQL Injection vulnerability. Specifically, all versions of the plugin up to and including 1.0.4 are at risk. If you are using any version within this range, your WordPress site could be vulnerable.
Current Status
This vulnerability has been officially "Analyzed." This means it has been investigated and confirmed, and details are available to help users understand and address the risk.
Severity Level
Rated as "Medium" severity with a CVSS score of 4.9, this vulnerability presents a moderate risk. While it requires an attacker to already have Administrator-level access to exploit, successful exploitation can lead to serious consequences, such as the unauthorized disclosure of sensitive data from your database. This could include user information, configuration details, or other critical website content.
Possible Solutions
The most important step to protect your WordPress site from CVE-2015-10146 is to update your "Thumbnail Slider With Lightbox" plugin immediately. The developers have released patches to address this issue. According to the plugin’s changelog, a fix for a similar vulnerability was included in version 1.0.18. Therefore, updating to version 1.0.5 or any later version (including the latest available version, currently 1.0.22) is crucial.
To update your plugin:
- Log in to your WordPress admin dashboard.
- Navigate to Plugins > Installed Plugins.
- Locate "Thumbnail Slider With Lightbox" or "WP Responsive Slider With Lightbox."
- If an update is available, click the "Update Now" link.
Always back up your website before performing any updates. Beyond updating, consistently follow WordPress security best practices, such as regularly reviewing user roles and permissions, and only granting administrator access to highly trusted individuals.
References
https://wordpress.org/plugins/wp-responsive-slider-with-lightbox
https://www.wordfence.com/threat-intel/vulnerabilities/id/70f04f90-a0b7-46d1-85da-e898a6981fa2?source=cve
