The Gallery Bank – Responsive Photo Gallery plugin exposes a Short Code named ‘gallery_bank’, in order to allow site publishers to insert galleries into pages / posts. This Short Code is vulnerable to a UNION based SQL Injection. This is possible by manipulating the field ‘show_albums’ when using this short code. This could allow any user who has access to edit, or publish pages or posts on a site to execute arbitrary SQL, and retrieve the output from such queries.
While it could be said that if a user has access to edit or publish pages or posts on a WordPress site, this vulnerability would be the least of your worries, however it’s quite possible to restrict users access to such an extent that their editor level access would grant them very little to no exploitable privileges.