Security Alert Summary
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress contains a time-based blind SQL injection vulnerability in the order_by parameter. Authenticated users with contributor-level access and above can exploit this by embedding a malicious shortcode in a post or draft, allowing injected SQL to execute when the shortcode is rendered and potentially enabling extraction of sensitive database information.
CVE Details
- CVE ID: CVE-2026-7048
- Affected component: Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress
- Affected versions: All versions up to and including 1.8.40
- Published: May 28, 2026 at 9:16:48 AM UTC
- Last modified: May 28, 2026 at 1:45:25 PM UTC
- CVSS v3.1: Base Score 6.5, MEDIUM, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Attack vector: Network
- Attack complexity: Low
- Privileges required: Low (authenticated, contributor-level access or higher)
- User interaction: None
- Scope: Unchanged
- Impact: Confidentiality: High; Integrity: None; Availability: None
- Weakness: CWE-89 (SQL Injection)
Technical Details
This vulnerability is a time-based blind SQL injection in the plugin’s handling of the order_by parameter. Insufficient escaping of user-supplied input and lack of proper preparation for the existing SQL query allow an authenticated user to append additional SQL to an existing query. According to the description, an attacker with contributor-level privileges can embed a malicious shortcode in a post or draft; when WordPress renders that shortcode, the crafted order_by input can cause the database to execute injected SQL statements.
Because this is described as time-based blind SQL injection, an attacker could extract data by causing queries that produce observable timing differences rather than visible query results. The issue stems from improper input handling for the order_by parameter and missing protections such as parameterized queries or sufficient escaping.
How This Could Impact Your Website
Consider a site with several user roles: the site owner who installs and configures plugins, internal staff who publish content, and external contributors or contractors who submit posts or drafts. If a contributor can insert a malicious shortcode that leverages the order_by parameter, an attacker may be able to run time-based queries that reveal sensitive information from the database.
- Internal user email addresses or other confidential records could be exposed, increasing the risk of targeted phishing or social engineering against staff.
- External contractors or contributors with access to post content could be used as an attack vector if their submitted content is not reviewed before rendering.
- Because the vulnerability requires authenticated access at contributor level or higher, limiting publishing privileges and reviewing drafts before they are rendered reduces risk.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior, including unexpected shortcode content or unusual database queries.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.39/framework/WDWLibrary.php#L1351
- https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.39/framework/WDWLibrary.php#L2112
- https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.39/frontend/controllers/controller.php#L354
- https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.39/photo-gallery.php#L789
- https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/framework/WDWLibrary.php#L1351
- https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/framework/WDWLibrary.php#L2112
- https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/frontend/controllers/controller.php#L354
- https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/photo-gallery.php#L789
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3532364%40photo-gallery&new=3532364%40photo-gallery&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/27394b03-3604-4fb0-950f-e1f838cabb05?source=cve
