The vulnerability is a time‑based blind SQL injection that occurs through the 'order_by' attribute of the plugin’s shortcode. By injecting malicious SQL into the attribute, an attacker can append queries to the existing statement, allowing extraction of sensitive database content. This flaw arises from insufficient input escaping and lack of prepared statements. The impact is the potential disclosure of confidential data stored in the WordPress database.

The defect affects the 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress. All releases up to and including version 1.8.40 are susceptible. Any site that has installed these versions and has users with contributor-level or higher privileges is at risk.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no documented widespread exploitation. The likely attack vector is a logical path where an authenticated contributor crafts a post or draft containing a malicious shortcode; when the page renders, the injected SQL executes. Successful exploitation requires the ability to create or modify content and the presence of the vulnerable plugin version.