Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1.
Published: 2026-10-06
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Data Exfiltration
Action: Immediate Patch
AI Analysis

Impact

This CVE reveals a blind, unauthenticated SQL Injection flaw that allows attackers to embed arbitrary SQL statements into queries executed by the Gmedia Photo Gallery plugin. Because the input is not properly sanitized, an attacker can read, modify, or delete database contents, leading to unauthorized data exposure and loss of integrity.

Affected Systems

The vulnerability affects the WordPress Gmedia Photo Gallery plugin managed by Serhii Pasyuk. All releases up to and including version 1.25.1 are impacted. Sites running these versions are at risk.

Risk and Exploitability

The vulnerability scores a CVSS of 9.3, indicating a high severity risk. The EPSS score is 0.00247, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw without any authentication, making it widely accessible. The impact can lead to data theft, alteration, or deletion, which may compromise the confidentiality, integrity, and availability of the affected site.

Generated by OpenCVE AI on October 17, 2026 at 08:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the latest version of the Gmedia Photo Gallery plugin (any release newer than 1.25.1).
  • If an update is not feasible immediately, disable or remove the plugin from the WordPress installation to block the attack surface.
  • Apply application-level input validation, ensuring that all incoming parameters used in database queries are bound using prepared statements or parameterized queries in accordance with CWE-89 best practices.

Generated by OpenCVE AI on October 17, 2026 at 08:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated SQL Injection in Gmedia Photo Gallery <= 1.25.1 versions. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1.

Tue, 06 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Serhii Pasiuk
Serhii Pasiuk gmedia Photo Gallery
Wordpress-extensions
Wordpress-extensions gmedia Photo Gallery
Vendors & Products Serhii Pasiuk
Serhii Pasiuk gmedia Photo Gallery
Wordpress-extensions
Wordpress-extensions gmedia Photo Gallery

Tue, 06 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated SQL Injection in Gmedia Photo Gallery <= 1.25.1 versions.
Title WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Serhii Pasiuk Gmedia Photo Gallery
Wordpress-extensions Gmedia Photo Gallery
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-13T16:31:43.279Z

Reserved: 2026-04-07T10:59:15.736Z

Link: CVE-2026-39785

cve-icon Vulnrichment

Updated: 2026-10-06T10:29:30.886Z

cve-icon NVD

Status : Deferred

Published: 2026-10-06T09:17:51.100

Modified: 2026-10-13T17:17:40.523

Link: CVE-2026-39785

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T08:30:05Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')