Junglewise Threat Intelligence

CVE-2026-76006: The Photo Gallery by Ays Responsive Image Gallery SQL injection via 's' parameter

CVE-2026-76006 · Severity: medium · CVSS 4.9 · Published 2026-09-01

Executive brief

The Photo Gallery by Ays plugin is a popular WordPress tool for creating and managing responsive image galleries. An authenticated administrator can inject malicious SQL commands through the search parameter to extract sensitive database information, potentially exposing customer data, user credentials, and other confidential information stored in WordPress databases.

Technical details

This is a SQL Injection vulnerability in the gallery-photo-gallery WordPress plugin (versions ≤6.8.2) affecting the 's' parameter due to insufficient input escaping and inadequate SQL query preparation. The vulnerability exists in two code paths: $wpdb->get_var() in record_count() and $wpdb->get_results() in prepare_items()/get_image_categories(). Both blind and UNION-based SQL injection techniques are possible. The attack requires authenticated access with administrator-level privileges or higher, and attackers can extract sensitive data from the WordPress database. A patch should be available in version 6.8.3 or later.

Affected products

  • Ays Themes The Photo Gallery by Ays – Responsive Image Gallery up to and including 6.8.2

Timeline

  • 2026-09-01: disclosed

References