# CVE-2026-7048: 10Web Photo Gallery SQL injection in order_by parameter

Source: https://junglewise.ai/threats/cve-2026-7048-10web-photo-gallery-sql-injection-in-order-by-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-7048 · Severity: medium · CVSS 6.5 · Published 2026-05-28

A popular WordPress plugin used for creating image galleries is vulnerable to a security flaw that could allow unauthorized data access. An attacker with basic contributor-level access can use this vulnerability to extract sensitive information from the website's database. This could lead to the exposure of user data or internal site configurations, potentially compromising the entire website.

Technologies: [10Web Photo Gallery](https://junglewise.ai/threats/technologies/photo-gallery). Vendors: [10Web](https://junglewise.ai/threats/vendors/10web).

## Quick answers

**Is CVE-2026-7048 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7048 being exploited in the wild.

**How severe is CVE-2026-7048?** Medium severity, with a CVSS score of 6.5, published 28 May 2026.

**Which products and versions are affected?** 10Web Photo Gallery Up to and including 1.8.40.

**Is there a fix for CVE-2026-7048?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7048 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-7048?** Check whether you run 10Web Photo Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Photo Gallery by 10Web plugin for WordPress is vulnerable to time-based blind SQL Injection due to insufficient escaping of the 'order_by' parameter and a lack of SQL query preparation. Authenticated attackers with contributor-level permissions or higher can exploit this by embedding a malicious shortcode into a post or draft. When the shortcode is rendered, the injected SQL commands execute against the database. This allows for the extraction of sensitive data using time-based inference techniques. The vulnerability affects all versions up to and including 1.8.40.

## Affected products

- 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery Up to and including 1.8.40

## Timeline

- 2026-05-28: disclosed: Advisory published by Wordfence and NVD

## References

- [https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.39/framework/WDWLibrary.php](https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.39/framework/WDWLibrary.php)
- [https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.39/framework/WDWLibrary.php](https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.39/framework/WDWLibrary.php)
- [https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.39/frontend/controllers/controller.php](https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.39/frontend/controllers/controller.php)
- [https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.39/photo-gallery.php](https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.39/photo-gallery.php)
- [https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/framework/WDWLibrary.php](https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/framework/WDWLibrary.php)
- [https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/framework/WDWLibrary.php](https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/framework/WDWLibrary.php)
- [https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/frontend/controllers/controller.php](https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/frontend/controllers/controller.php)

## Related threats

- [Photo Gallery by 10Web stored cross-site scripting in watermark attribute](https://junglewise.ai/threats/cve-2026-110072-the-photo-gallery-by-10web-wordpress-plugin-before-1-8-49-does)
- [Photo Gallery by 10Web unauthenticated cross-site scripting](https://junglewise.ai/threats/cve-2026-42715-unauthenticated-cross-site-scripting-xss-in-photo-gallery-by)
- [Photo Gallery by 10Web reflected XSS via thumb_url parameter](https://junglewise.ai/threats/cve-2026-92974-the-photo-gallery-by-10web-mobile-friendly-image-gallery-plugin)
- [Photo Gallery by 10Web PHP object injection](https://junglewise.ai/threats/cve-2026-102377-contributor-php-object-injection-in-photo-gallery-by-10web-1-8)
- [10Web Photo Gallery time-based SQL injection in album_id shortcode attribute](https://junglewise.ai/threats/cve-2026-85652-10web-photo-gallery-time-based-sql-injection-in-album-id)