Photo Gallery by 10Web CVE-2026-7048

Exploitation requires an active WordPress user account with contributor role or higher - anonymous users and subscriber-role accounts cannot trigger shortcode rendering in the necessary context. The Photo Gallery by 10Web plugin must be installed and activated on the target site. The SQL payload must be delivered via the order_by shortcode parameter and will only execute at shortcode render time (post preview, published page load, or widget rendering). The attacker can self-trigger exploitation by previewing their own draft, requiring no victim interaction. Sites that do not grant contributor access to untrusted parties, or that disable the plugin, are not exploitable through this vector. Non-WordPress deployments are not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) yields a score of 6.5, reflecting network-reachable, low-complexity exploitation requiring only low-privilege authentication, with high confidentiality impact but no integrity or availability degradation. The PR:L requirement (contributor role) is a real barrier on tightly managed sites but is negligible on platforms with open registration, editorial teams, or guest-blogging workflows. Scope:Unchanged and I:N/A:N confirm the attack is limited to data exfiltration - the attacker cannot modify or destroy data through this vector alone. No EPSS score was supplied in the available data, and no active exploitation is confirmed (no CISA KEV listing, no identified public POC). The shortcode-as-delivery-mechanism adds a slight operational step but does not increase effective attack complexity meaningfully, as contributors can self-trigger the payload via post preview. Overall, this is a legitimate priority for WordPress sites with contributor-level access granted to untrusted or semi-trusted users, and a lower priority for sites where all editors are fully trusted.

An attacker registered as a contributor on a WordPress site embeds a gallery shortcode in a new draft post, manipulating the order_by attribute to include a time-based SQL payload such as a conditional SLEEP() statement. The attacker previews the draft, causing WordPress to render the shortcode server-side and execute the injected SQL against the underlying MySQL database. Through repeated timing measurements, the attacker enumerates the WordPress wp_users table to extract hashed passwords and email addresses for all site accounts. No public POC has been identified at time of analysis.