What is the CVSS score of CVE-2026-9829?

CVE-2026-9829 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Photo Gallery by 10Web CVE-2026-9829

EUVD-2026-34962 MEDIUM

SQL Injection (CWE-89)

2026-06-06 Wordfence

GHSA-xh2v-3wq6-997q

SQLi WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:21 vuln.today

CVE Published

Jun 06, 2026 - 04:28 nvd

MEDIUM 6.5

DescriptionCVE.org

The Photo Gallery by 10Web - Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'compact_album_order_by' Shortcode Parameter in all versions up to, and including, 1.8.41 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The malicious payload is stored via the 'shortcode_bwg' AJAX handler - accessible to Contributor-level users and exploitable without a valid nonce by omitting the 'page' parameter - and is subsequently triggered by the unauthenticated 'bwg_frontend_data' AJAX handler, meaning successful exploitation requires only that an attacker has Contributor-level access to save the shortcode.

AnalysisAI

Time-based SQL injection in the Photo Gallery by 10Web WordPress plugin (all versions through 1.8.41) enables authenticated contributors to exfiltrate arbitrary data from the WordPress database via a stored shortcode payload that is subsequently triggered without authentication. The attack exploits the 'compact_album_order_by' parameter passed through the 'shortcode_bwg' AJAX handler, where insufficient escaping and absent query preparation allow appended SQL clauses to survive into execution. Critically, the stored malicious shortcode can be activated by the unauthenticated 'bwg_frontend_data' AJAX handler, collapsing the effective authentication barrier after the initial store step. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command) within the plugin's frontend data model. Source code references confirm the flaw exists in frontend/models/model.php at lines 113 and 162 across both versions 1.8.40 and 1.8.41, where the 'compact_album_order_by' shortcode parameter is incorporated into an SQL ORDER BY clause without parameterization or adequate escaping. The 'shortcode_bwg' AJAX handler (admin/controllers/Shortcode.php line 59) accepts and persists this parameter for Contributor-level users, while WDWLibrary.php (line 2281) and the plugin's main bootstrap (photo-gallery.php line 717) wire up the 'bwg_frontend_data' AJAX handler without an authentication check, enabling the stored payload to be detonated by unauthenticated requests. The affected CPE is cpe:2.3:a:10web:photo_gallery_by_10web_-_mobile-friendly_image_gallery:*:*:*:*:*:*:*:*, spanning all versions up to and including 1.8.41. Time-based techniques (e.g., SLEEP() or BENCHMARK()) are the inferred injection method, consistent with the CVE description's 'time-based SQL Injection' classification.

RemediationAI

An upstream fix has been committed via WordPress plugin repository changeset 3553847 (https://plugins.trac.wordpress.org/changeset/3553847); however, the exact patched release version number is not explicitly confirmed in the available data - site administrators should update the plugin to the latest available version in the WordPress plugin directory, which is expected to be 1.8.42 or higher, and verify the installed version exceeds 1.8.41. Until patching is confirmed, the most targeted compensating control is to audit and restrict Contributor-level account creation: disable open registration, remove untrusted Contributor accounts, and review existing shortcode content for anomalous 'compact_album_order_by' values. Blocking unauthenticated access to WordPress AJAX endpoints (specifically wp-admin/admin-ajax.php for the 'bwg_frontend_data' action) via WAF rules or server-level controls will sever the trigger phase - note this may break legitimate gallery rendering for anonymous visitors. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/cae7dabd-ce43-43e3-9f67-b2de55bd720b should be monitored for confirmed patch version confirmation.