Is CVE-2026-9829 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9829 being exploited in the wild.

How severe is CVE-2026-9829?

Medium severity, with a CVSS score of 6.5, published 6 June 2026.

Which products and versions are affected?

10Web Photo Gallery by 10Web up to, and including, 1.8.41.

Is there a fix for CVE-2026-9829?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9829 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9829?

Check whether you run 10Web Photo Gallery by 10Web at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9829: 10Web Photo Gallery SQL injection in compact_album_order_by shortcode

CVE-2026-9829 · Severity: medium · CVSS 6.5 · Published 2026-06-06

A popular WordPress plugin used for creating image galleries is vulnerable to a security flaw that allows certain logged-in users to access sensitive information from the website's database. By saving a specially crafted gallery configuration, an attacker with contributor-level access can execute hidden database commands. This could lead to the exposure of private site data, including user details or configuration settings.

Vendors: 10Web.

Quick answers

Is CVE-2026-9829 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9829 being exploited in the wild.
How severe is CVE-2026-9829?: Medium severity, with a CVSS score of 6.5, published 6 June 2026.
Which products and versions are affected?: 10Web Photo Gallery by 10Web up to, and including, 1.8.41.
Is there a fix for CVE-2026-9829?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9829 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9829?: Check whether you run 10Web Photo Gallery by 10Web at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Photo Gallery by 10Web plugin for WordPress is vulnerable to time-based SQL Injection due to insufficient escaping and lack of preparation on the 'compact_album_order_by' shortcode parameter. Authenticated attackers with Contributor-level permissions can inject malicious SQL queries via the 'shortcode_bwg' AJAX handler. The vulnerability is exploitable without a valid nonce by omitting the 'page' parameter. The injected payload is stored and subsequently executed by the unauthenticated 'bwg_frontend_data' AJAX handler, allowing for the extraction of sensitive information from the database. A patch is available in versions following 1.8.41.

Affected products

10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery up to, and including, 1.8.41

Timeline

2026-06-06: disclosed
2026-06-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.