Photo Gallery by Ays EUVD-2026-68974

Exploitation requires a valid WordPress account with administrator-level privileges or higher - confirmed by the CVSS:3.1 PR:H metric. The attacker must be able to authenticate to the WordPress admin panel (wp-admin) and reach the Photo Gallery by Ays plugin's image categories list view, which is where the 's' parameter is processed. The vulnerability is not exploitable by subscriber, contributor, editor, or shop manager roles. Three conditions limit exploitation: (1) the Photo Gallery by Ays plugin must be installed and active on the target site; (2) the attacker must possess or separately obtain valid administrator credentials; (3) the wp-admin interface must be network-reachable from the attacker's position. Sites that restrict wp-admin by IP allowlist, require VPN access, or enforce multi-factor authentication on admin accounts significantly reduce realistic exploitability despite the network attack vector.

The CVSS 3.1 score of 4.9 (Medium) accurately reflects the constrained real-world risk of this vulnerability. The PR:H metric is the dominant limiting factor: exploitation requires a valid WordPress administrator account, which dramatically narrows the attack surface - an actor who already holds admin credentials has numerous native means to access database content without chaining an exploit. The AV:N/AC:L metrics confirm that once credentials are in hand, exploitation is straightforward over the network with no additional complexity. EPSS data is absent from the available intelligence, preventing probability-based triage. KEV status is not listed and no public exploit code has been identified, consistent with the high privilege bar deterring automated or opportunistic exploitation. The unchanged scope (S:U) and I:N/A:N impact components confirm the blast radius is limited strictly to confidentiality - an attacker cannot modify data or disrupt availability through this path. For the majority of deployments this is a low-urgency remediation item, though shared hosting or SaaS WordPress environments where administrator access is distributed across many tenant accounts face moderately elevated risk due to the broader credential attack surface.

An attacker who has obtained WordPress administrator credentials - through credential stuffing, phishing, or a previously compromised account - navigates to the Photo Gallery plugin's image categories management page within wp-admin and submits a crafted value via the 's' search parameter. The unsanitized input is passed directly into $wpdb->get_var() or $wpdb->get_results(), allowing the attacker to inject UNION-based or time-based blind SQL clauses that progressively dump user credential hashes, WordPress secret keys, or other sensitive database contents. No public proof-of-concept code has been identified at time of analysis.