EUVD-2026-34962
GHSA-xh2v-3wq6-997q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or compromise Contributor-level WordPress account
-
DeliveryPOST to shortcode_bwg AJAX handler omitting 'page' parameter to bypass nonce
-
ExploitInject time-based SQLi payload into compact_album_order_by parameter
-
ExecutionPayload stored in database via shortcode configuration
-
PersistSend unauthenticated request to bwg_frontend_data AJAX handler
-
ImpactTime-based SQL injection executes and leaks database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The store phase requires an authenticated WordPress account with at minimum Contributor role (PR:L per CVSS vector); this is the binding prerequisite for exploitation. The nonce check on the 'shortcode_bwg' AJAX handler can be bypassed entirely by omitting the 'page' parameter, removing what would otherwise be a meaningful CSRF barrier. The trigger phase requires no authentication whatsoever - the 'bwg_frontend_data' AJAX handler processes the stored malicious shortcode for any unauthenticated caller. The Photo Gallery by 10Web plugin must be installed and active. Exploitation is limited to data exfiltration (C:H, I:N, A:N); no write or denial-of-service primitive is available through this vector alone. Sites where Contributor-level registration is closed or where the Photo Gallery plugin is deactivated are not exploitable via this path. |
| Impact | The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects network-reachable, low-complexity exploitation requiring only low privileges (Contributor role) with no user interaction, yielding high confidentiality impact but no integrity or availability loss. However, the real-world attack surface is more nuanced: the CVSS PR:L captures the initial store phase, but the trigger phase via 'bwg_frontend_data' is fully unauthenticated - meaning once a single Contributor account is compromised or registered, the database extraction window is open to any unauthenticated party. WordPress sites that allow open user registration at Contributor level, or those with many authors and editors, face meaningfully elevated exposure. The nonce bypass (by omitting the 'page' parameter on the 'shortcode_bwg' handler) further reduces friction for the store phase. No EPSS score is available in the provided data, and the CVE is not listed in CISA KEV, so exploitation priority should be driven by whether the target site allows Contributor-level account creation or has untrusted contributors. No public exploit code has been identified, but the detailed source code references in Wordfence's disclosure lower the barrier for independent reproduction. |
| Exploit ScenarioDerived | An attacker registers or compromises a Contributor account on the target WordPress site, then crafts an AJAX POST to the 'shortcode_bwg' handler with a malicious 'compact_album_order_by' value containing a time-based SQL payload, deliberately omitting the 'page' parameter to bypass nonce validation. The injected value is persisted in the database as part of the shortcode configuration. Subsequently, the attacker - or any unauthenticated party - sends a request to the 'bwg_frontend_data' AJAX action, which processes the stored shortcode and executes the SQL payload, leaking WordPress database contents (users, hashed passwords, configuration data) through measurable response-time differentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 06, 2026
Time-based SQL injection in the Photo Gallery by 10Web WordPress plugin (all versions through 1.8.41) enables authenticated contributors to exfiltrate arbitrary data from the WordPress database via a stored shortcode payload that is subsequently triggered without authentication. The attack exploits the 'compact_album_order_by' parameter passed through the 'shortcode_bwg' AJAX handler, where insufficient escaping and absent query preparation allow appended SQL clauses to survive into execution. Critically, the stored malicious shortcode can be activated by the unauthenticated 'bwg_frontend_data' AJAX handler, collapsing the effective authentication barrier after the initial store step. No public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
An upstream fix has been committed via WordPress plugin repository changeset 3553847 (https://plugins.trac.wordpress.org/changeset/3553847); however, the exact patched release version number is not explicitly confirmed in the available data - site administrators should update the plugin to the latest available version in the WordPress plugin directory, which is expected to be 1.8.42 or higher, and verify the installed version exceeds 1.8.41. Until patching is confirmed, the most targeted compensating control is to audit and restrict Contributor-level account creation: disable open registration, remove untrusted Contributor accounts, and review existing shortcode content for anomalous 'compact_album_order_by' values. Blocking unauthenticated access to WordPress AJAX endpoints (specifically wp-admin/admin-ajax.php for the 'bwg_frontend_data' action) via WAF rules or server-level controls will sever the trigger phase - note this may break legitimate gallery rendering for anonymous visitors. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/cae7dabd-ce43-43e3-9f67-b2de55bd720b should be monitored for confirmed patch version confirmation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command) within the plugin's frontend data model. Source code references confirm the flaw exists in frontend/models/model.php at lines 113 and 162 across both versions 1.8.40 and 1.8.41, where the 'compact_album_order_by' shortcode parameter is incorporated into an SQL ORDER BY clause without parameterization or adequate escaping. The 'shortcode_bwg' AJAX handler (admin/controllers/Shortcode.php line 59) accepts and persists this parameter for Contributor-level users, while WDWLibrary.php (line 2281) and the plugin's main bootstrap (photo-gallery.php line 717) wire up the 'bwg_frontend_data' AJAX handler without an authentication check, enabling the stored payload to be detonated by unauthenticated requests. The affected CPE is cpe:2.3:a:10web:photo_gallery_by_10web_-_mobile-friendly_image_gallery:*:*:*:*:*:*:*:*, spanning all versions up to and including 1.8.41. Time-based techniques (e.g., SLEEP() or BENCHMARK()) are the inferred injection method, consistent with the CVE description's 'time-based SQL Injection' classification.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Photo Gallery by 10Web - Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'compact_album_order_by' Shortcode Parameter in all versions up to, and including, 1.8.41 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The malicious payload is stored via the 'shortcode_bwg' AJAX handler - accessible to Contributor-level users and exploitable without a valid nonce by omitting the 'page' parameter - and is subsequently triggered by the unauthenticated 'bwg_frontend_data' AJAX handler, meaning successful exploitation requires only that an attacker has Contributor-level access to save the shortcode.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB