10Web Photo Gallery EUVD-2026-82759

Requires an authenticated WordPress account with Author-level capability or higher (PR:L) on a site running Photo Gallery by 10Web ≤1.8.44 - the attacker must be able to publish a post and insert a Photo Gallery shortcode carrying a crafted album_id attribute. No non-default plugin configuration is needed; the vulnerable album_id handling is in the standard frontend gallery rendering path. Exploitation is limited by (1) the Author authentication gate, so it is not reachable by anonymous internet users, and (2) the time-based BLIND nature of the injection, making extraction slow. The payload executes when any visitor renders the post containing the malicious shortcode, so no direct admin interaction is required to trigger it.

Signals are moderate and internally consistent. CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) frames this as a network-exploitable, low-complexity SQL injection whose main impact is confidentiality (database extraction), gated by PR:L - Author-level authentication. No EPSS score, no CISA KEV listing, and no public POC are provided, so this is 'no public exploit identified at time of analysis.' The C:H rating is justified because SQL injection into a WordPress database exposes all rows including password hashes and secret keys; however, the technique is time-based BLIND injection, meaning extraction is slow and noisy rather than instantaneous, which tempers the practical severity somewhat. The PR:L gate is the key limiter: an attacker must already hold at least Author privileges on the target site, so this is not mass-exploitable against arbitrary internet hosts - it is a privilege-escalation/data-theft primitive for compromised or malicious low-trust accounts. Net: a real but not top-tier priority - patch promptly on multi-author sites, lower urgency on single-admin installs. No conflicting signals detected; the CVSS vector matches the description.

An attacker who has registered or compromised an Author-level account on a WordPress site running Photo Gallery by 10Web embeds a malicious album_id value inside a Photo Gallery shortcode within a published post. When any visitor (or admin) renders that post, the unsanitized album_id is concatenated into a UNION-based query, and a time-based blind payload lets the attacker infer database contents (e.g., admin password hashes, secret keys) character-by-character from response delays. No public exploit code is currently identified, but the vulnerable source lines are pinpointed in the WordPress plugin trac references.