Gmedia Photo Gallery CVE-2026-96661

No special conditions beyond product presence: the unauthenticated mobile-app endpoint dispatches the 'library' action and reaches the 'gmedia__in' SQL sink WITHOUT validating the Mobile App feature flag, a nonce, or any WordPress authentication, so remote unauthenticated exploitation works against default installations of Gmedia Photo Gallery versions up to and including 1.25.1. The only meaningful limiting factors are that the site must run the plugin at a vulnerable version and the endpoint must be network-reachable; impact is limited to reading data (time-based blind extraction), not modification, so exfiltration is slower and noisier than an error-based injection.

This is a genuine high-priority issue, not an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is fully consistent with the description: the vulnerable 'gmedia__in' parameter is reached through an unauthenticated mobile-app endpoint that dispatches the library action without checking the Mobile App feature flag, a nonce, or any WordPress session, so network-reachable attackers need no account and no user interaction. The time-based blind SQLi (CWE-89) yields C:H/I:N/A:N, which matches a read-only data-extraction primitive. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis'; however, the combination of pre-auth reachability, low attack complexity, and a Wordfence-authored advisory with direct source-line references makes weaponization and scanning plausible once details propagate. The main signal to weigh down is prevalence: this is a single WordPress gallery plugin rather than ubiquitous infrastructure, so real-world blast radius depends on install base. No conflicting signals were found between the CVSS vector and the description - both agree on unauthenticated network access.

A remote, unauthenticated attacker sends a crafted request to the plugin's mobile-app library endpoint with a malicious 'gmedia__in' value, injecting time-delay SQL conditions into the existing query. By observing response-time differences, the attacker performs blind extraction of sensitive data such as WordPress user records and password hashes. No public exploit code was identified at the time of analysis, but the low complexity and lack of authentication make a working exploit straightforward to develop.