CVE-2026-7048

Vulnerability

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions up to and including 1.8.40 is vulnerable to time-based blind SQL injection in the order_by parameter of the gallery shortcode. The plugin fails to properly escape user-supplied input and does not prepare the SQL query adequately, allowing an attacker to inject arbitrary SQL fragments. The vulnerable code is present in the frontend controller's execute method, where the sort_by parameter is processed without sufficient sanitization [1][3]. The parameter is directly used in an SQL query, as seen in the handling of WDWLibrary::get('sortImagesByValue_' . $bwg) [3][4].

Exploitation

An authenticated attacker with at least contributor-level access to WordPress can exploit this vulnerability by embedding a malicious shortcode in a post or draft. When the shortcode is rendered, the attacker-controlled order_by parameter is processed, and the unsanitized input is appended to an existing SQL query. By using time-based payloads, the attacker can infer the contents of the database through blind SQL injection techniques. No additional privileges beyond contributor are required, and the attack does not require user interaction beyond the rendering of the crafted content.

Impact

Successful exploitation allows the attacker to extract sensitive information from the WordPress database, such as user credentials, session tokens, or other confidential data. The injection is limited to appending SQL queries within the existing query context, but this is sufficient for time-based data extraction. The attacker does not gain direct remote code execution or file write access, but the confidentiality of the database is compromised.

Mitigation

The vendor has released version 1.8.41, which addresses this vulnerability by fixing the insufficient escaping and lack of prepared statements [1][2]. Users should update the plugin to version 1.8.41 or later immediately. There are no known workarounds for sites that cannot update, and the plugin is not known to be listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.