CVE-2026-9829

Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter

View on CVE.org
Published Jun 6, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'compact_album_order_by' Shortcode Parameter in all versions up to, and including, 1.8.41 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The malicious payload is stored via the 'shortcode_bwg' AJAX handler — accessible to Contributor-level users and exploitable without a valid nonce by omitting the 'page' parameter — and is subsequently triggered by the unauthenticated 'bwg_frontend_data' AJAX handler, meaning successful exploitation requires only that an attacker has Contributor-level access to save the shortcode.

Analysis

AI-generated

Technical impact

The vulnerability exists in all releases of the Photo Gallery by 10Web plugin up to version 1.8.41. It is caused by insufficient escaping of the compact_album_order_by shortcode parameter and the absence of prepared statements, which allows an authenticated contributor or higher to inject arbitrary SQL. The injection payload is stored via the shortcode_bwg AJAX handler and later executed through the bwg_frontend_data endpoint, enabling the attacker to read or exfiltrate any database information.

Affected Systems

WordPress sites that have installed the 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin version 1.8.41 or earlier are affected. No other vendors or products are listed in the CNA data for this entry.

Risk and Exploitability

The CVSS score of 6.5 rates the vulnerability as moderate, and the EPSS score is not available, leaving the exact exploitation likelihood uncertain. An attacker must first obtain contributor-level or higher access but can then persist the injected query and trigger it through normal site traffic, making the threat persistent. The vulnerability is not listed in the CISA KEV catalog, yet the lack of mitigation does not diminish the need for prompt action.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Photo Gallery by 10Web plugin to the latest available version (≥ 1.8.42 or newer).
  • Restrict contributor-level and higher WordPress user roles to trusted administrators, or remove contributor permissions from sites that do not require them.
  • Disable or block the shortcode_bwg AJAX endpoint for contributor-level users until a patch is applied.
  • Implement input validation or a web application firewall rule to filter dangerous characters in the compact_album_order_by parameter as a temporary countermeasure.

Generated by OpenCVE AI on June 6, 2026 at 06:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared 10web
10web photo Gallery By 10web – Mobile-friendly Image Gallery
Wordpress
Wordpress wordpress
Vendors & Products 10web
10web photo Gallery By 10web – Mobile-friendly Image Gallery
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'compact_album_order_by' Shortcode Parameter in all versions up to, and including, 1.8.41 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The malicious payload is stored via the 'shortcode_bwg' AJAX handler — accessible to Contributor-level users and exploitable without a valid nonce by omitting the 'page' parameter — and is subsequently triggered by the unauthenticated 'bwg_frontend_data' AJAX handler, meaning successful exploitation requires only that an attacker has Contributor-level access to save the shortcode.
Title Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Jun 6, 2026, 11:41 AM
Reserved
May 28, 2026, 12:02 PM

View source JSON

Updated
Jun 6, 2026, 11:41 AM

JSON

Status
Deferred
Published
Jun 6, 2026, 5:16 AM
Modified
Jul 23, 2026, 7:10 AM

View source JSON

No data.

Updated
Jun 6, 2026, 6:30 AM

JSON