The vulnerability exists in all releases of the Photo Gallery by 10Web plugin up to version 1.8.41. It is caused by insufficient escaping of the compact_album_order_by shortcode parameter and the absence of prepared statements, which allows an authenticated contributor or higher to inject arbitrary SQL. The injection payload is stored via the shortcode_bwg AJAX handler and later executed through the bwg_frontend_data endpoint, enabling the attacker to read or exfiltrate any database information.

WordPress sites that have installed the 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin version 1.8.41 or earlier are affected. No other vendors or products are listed in the CNA data for this entry.

The CVSS score of 6.5 rates the vulnerability as moderate, and the EPSS score is not available, leaving the exact exploitation likelihood uncertain. An attacker must first obtain contributor-level or higher access but can then persist the injected query and trigger it through normal site traffic, making the threat persistent. The vulnerability is not listed in the CISA KEV catalog, yet the lack of mitigation does not diminish the need for prompt action.