Junglewise Threat Intelligence

CVE-2026-9829: 10Web Photo Gallery SQL injection in compact_album_order_by shortcode

CVE-2026-9829 · Severity: medium · CVSS 6.5 · Published 2026-06-06

Executive brief

A popular WordPress plugin used for creating image galleries is vulnerable to a security flaw that allows certain logged-in users to access sensitive information from the website's database. By saving a specially crafted gallery configuration, an attacker with contributor-level access can execute hidden database commands. This could lead to the exposure of private site data, including user details or configuration settings.

Technical details

The Photo Gallery by 10Web plugin for WordPress is vulnerable to time-based SQL Injection due to insufficient escaping and lack of preparation on the 'compact_album_order_by' shortcode parameter. Authenticated attackers with Contributor-level permissions can inject malicious SQL queries via the 'shortcode_bwg' AJAX handler. The vulnerability is exploitable without a valid nonce by omitting the 'page' parameter. The injected payload is stored and subsequently executed by the unauthenticated 'bwg_frontend_data' AJAX handler, allowing for the extraction of sensitive information from the database. A patch is available in versions following 1.8.41.

Affected products

  • 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery up to, and including, 1.8.41

Timeline

  • 2026-06-06: disclosed
  • 2026-06-06: advisory

References

Related threats