What is the CVSS score of CVE-2026-7048?

CVE-2026-7048 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Photo Gallery by 10Web CVE-2026-7048

EUVD-2026-32744 MEDIUM

SQL Injection (CWE-89)

2026-05-28 Wordfence

GHSA-5v9v-f8v4-w6g4

SQLi WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 09:23 vuln.today

CVE Published

May 28, 2026 - 07:43 nvd

MEDIUM 6.5

DescriptionCVE.org

The Photo Gallery by 10Web - Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.8.40 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable by embedding a malicious shortcode in a post or draft, allowing the injected SQL to execute when the shortcode is rendered.

AnalysisAI

Time-based blind SQL injection in the Photo Gallery by 10Web WordPress plugin (all versions through 1.8.40) allows authenticated attackers holding contributor-level access or above to exfiltrate sensitive database contents by embedding a crafted shortcode in a post or draft. The order_by parameter is passed unsanitized into existing SQL queries, and the injected payload executes when the shortcode is rendered - targeting WordPress databases containing credentials, user PII, and site configuration. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high confidentiality impact and low attack complexity make this a meaningful risk on any site with non-administrative contributors.

Technical ContextAI

The vulnerability originates in two files of the plugin's framework layer: framework/WDWLibrary.php (lines 1351 and 2112) and frontend/controllers/controller.php (line 354), as confirmed by multiple WordPress Trac source browser references. The order_by shortcode parameter is insufficiently escaped before concatenation into raw SQL queries - the root cause class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The exploitation pathway is distinctively indirect: the malicious SQL payload is dormant inside a shortcode attribute until a page rendering event triggers execution server-side, bypassing some naive input-validation approaches that only inspect form submissions. The time-based blind technique (using conditional delay functions such as MySQL's SLEEP() or BENCHMARK()) infers database content bit-by-bit through measured response latency, requiring no direct query output channel. The affected CPE is cpe:2.3:a:10web:photo_gallery_by_10web_-_mobile-friendly_image_gallery:*:*:*:*:*:*:*:*, covering all versions up to and including 1.8.40.

RemediationAI

An upstream fix has been committed to the plugin's trunk repository, as evidenced by the WordPress Trac changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3532364%40photo-gallery&new=3532364%40photo-gallery; however, a specific patched release version number is not independently confirmed from the available data - the described fix targets versions beyond 1.8.40. Administrators should immediately update the Photo Gallery by 10Web plugin to the latest available release via the WordPress dashboard and confirm the installed version exceeds 1.8.40. As a compensating control during the patching window, restrict contributor-role access to only fully trusted individuals, since contributor-level is the minimum privilege required for exploitation. If the plugin is not essential to site operations, temporarily deactivating it is a viable zero-risk mitigation, with the trade-off that all rendered photo galleries will be removed from the frontend until the plugin is updated and re-enabled. Do not rely on WAF rules alone as the primary control for blind SQLi without testing for bypass.