Gmedia Photo Gallery CVE-2026-39785

Exploitation requires only that a reachable WordPress site have the Gmedia Photo Gallery plugin (version 1.25.1 or earlier) installed and active; the vector is AV:N/AC:L/PR:N/UI:N, so no authentication, no privileged account, and no victim interaction are needed against a default installation. The primary limiting factors are therefore deployment-based rather than configuration-based: the target must run an affected plugin version that has not been updated past 1.25.1, and the vulnerable endpoint must be network-reachable (not blocked by a WAF or access restriction). The exact request parameter is not specified in the provided data, so the specific triggering feature of the plugin should be confirmed from the Patchstack advisory.

This is a genuine high-priority issue, not a CVSS-inflated one. The vendor (Patchstack) CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms a network-reachable, low-complexity, unauthenticated flaw - the most dangerous profile for a WordPress plugin, since any internet-facing site running the plugin can be attacked directly. CWE-89 (SQL Injection) with C:H means full read access to the WordPress database, which typically exposes user password hashes, session/auth tokens, and secrets, making account takeover a realistic downstream outcome. The vendor also set S:C (scope change) and A:L, consistent with an injection that can reach beyond the plugin's own data into the shared database and cause limited availability disruption. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so exploitation probability cannot be quantified from the data at hand; absence of KEV/POC is NOT evidence of safety, because unauthenticated SQLi in WordPress plugins is a heavily automated, mass-scanned bug class and Patchstack-reported plugin SQLi frequently sees opportunistic exploitation shortly after disclosure. One signal to note: the vendor marked I:N (no integrity impact), which is unusual for SQLi - many SQLi flaws also permit data modification - so the actual integrity exposure should be verified against the Patchstack advisory rather than assumed to be read-only.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable plugin endpoint on a public WordPress site, injecting SQL into an unsanitized parameter. Because no authentication or user interaction is required (PR:N/UI:N), the attacker extracts database contents - including WordPress user records and password hashes - enabling follow-on administrator account compromise. No public exploit identified at time of analysis, so exploitation currently requires the attacker to craft the injection independently.