Description
Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.
Published: 2026-09-30
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Contributor PHP Object Injection exists in Photo Gallery by 10Web plugin versions up to 1.8.46. This flaw allows an attacker to construct a malicious serialized object that, when processed by the plugin, can lead to arbitrary code execution on the WordPress site. The weakness corresponds to CWE-502 and can compromise the confidentiality, integrity, and availability of the affected web application.

Affected Systems

The vulnerability affects the WordPress Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin, all installations running version 1.8.46 or earlier.

Risk and Exploitability

The CVSS score of 8.8 demonstrates high severity. The EPSS score is not available, providing no insight into current exploitation trends, and the vulnerability is not listed in the CISA KEV catalog. Based on the nature of PHP Object Injection, the most likely attack vector involves an authenticated or unauthenticated user submitting a crafted payload to the plugin’s input processing endpoint, leading to code execution on the server.

Generated by OpenCVE AI on September 30, 2026 at 19:18 UTC.

Remediation

Vendor Solution

Update the WordPress Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin to the latest available version (at least 1.8.47).

OpenCVE Recommended Actions

  • Update the WordPress Photo Gallery by 10Web plugin to version 1.8.47 or later.
  • If an immediate update is not possible, disable the plugin to eliminate the exploitation surface.
  • Monitor application logs for suspicious activity and verify that no unauthorized code execution attempts occur.

Generated by OpenCVE AI on September 30, 2026 at 19:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.
Title WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-09-30T17:59:54.957Z

Reserved: 2026-09-29T00:15:56.341Z

Link: CVE-2026-102377

cve-icon Vulnrichment

Updated: 2026-09-30T17:59:14.821Z

cve-icon NVD

Status : Deferred

Published: 2026-09-30T18:18:14.393

Modified: 2026-09-30T19:04:41.917

Link: CVE-2026-102377

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T19:30:18Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data