Photo Gallery by 10Web CVE-2026-49771

Exploitation requires an authenticated WordPress session with high privileges (CVSS PR:H - typically administrator or a custom role granting access to the Photo Gallery plugin's admin/AJAX endpoints) on a site where Photo Gallery by 10Web at version 1.8.41 or earlier is installed and activated; no user interaction is required (UI:N) and no special non-default configuration of the plugin is needed beyond activation. Limiting factors that reduce realistic risk: the PR:H prerequisite means external unauthenticated attackers cannot directly exploit, the vulnerable endpoint must be network-reachable to the attacker's authenticated session, and integrity is unaffected (I:N) so the primitive is data-disclosure / availability rather than write-anywhere SQL.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L yields 7.6 (High), driven primarily by network reachability, low complexity, high confidentiality impact, and a Scope change reflecting that the SQL engine sits in a different security authority than the plugin. The PR:H requirement materially lowers real-world risk: an attacker must already hold a high-privilege WordPress account (typically administrator-equivalent), which means this is more a post-compromise data-exfiltration primitive than an initial-access vulnerability. There is no EPSS score provided, no CISA KEV listing, and no SSVC decision data in the input, and no POC was referenced - so exploitation pressure appears low at this time. Prioritization should be moderate: patch promptly on multi-tenant or shared WordPress environments where lower-trust admins exist, but it is unlikely to be a target for mass automated exploitation given the privilege prerequisite.

An attacker who has obtained or been granted a high-privilege WordPress account (administrator or equivalent) on a site running Photo Gallery by 10Web ≤ 1.8.41 sends crafted requests to a vulnerable plugin endpoint containing time-based or boolean-based SQL payloads. Because the response is blind, the attacker iteratively infers contents of the wp_users and wp_options tables - extracting password hashes, secret keys, and API tokens - to escalate access further or pivot to other tenants on a shared WordPress install. No public exploit code has been identified at the time of analysis.