CVE-2026-9829: Photo Gallery by 10Web SQL Injection Vulnerability in WordPress

Technical summary

The vulnerability stems from insufficient input escaping and improper SQL query preparation of the 'compact_album_order_by' parameter within the photo gallery shortcode. The vulnerable code path involves two AJAX handlers: 'shortcode_bwg' (which accepts and stores the shortcode without adequate CSRF protection or nonce validation when the 'page' parameter is omitted) and 'bwg_frontend_data' (a public-facing handler that triggers stored payloads). Time-based SQL injection techniques allow an attacker to exfiltrate data byte-by-byte by crafting conditional SQL statements that delay database responses. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Business impact

Compromise of database confidentiality is the primary risk. Attackers can extract user accounts, email addresses, post content, plugin settings, and any custom data stored in the WordPress database. While integrity and availability are not directly impacted, stolen data can fuel further attacks, including account takeovers, phishing campaigns, or targeted social engineering. For multi-site WordPress installations or sites handling sensitive content (e-commerce, membership sites, client portfolios), data exposure poses legal and reputational harm. The low barrier to entry—only contributor-level access is required—makes this a concern for sites with many authors, freelancers, or temporary users.

Affected systems

All versions of the Photo Gallery by 10Web plugin up to and including version 1.8.41 are vulnerable. The plugin is installed on thousands of WordPress sites. Any WordPress site running this plugin with contributor-level (or higher) users is at risk. Sites with open user registration, guest author programs, or agencies managing client sites with distributed access are especially exposed.

Exploitability

Exploitability is moderate to high. An attacker needs valid WordPress contributor credentials, which are easier to obtain than admin access and may be legitimately held by many users. No valid nonce token is required if the attacker omits the 'page' parameter in the AJAX request, simplifying the attack. The stored nature of the payload means the attacker does not need to be present when the data is exfiltrated—any site visitor triggers the malicious shortcode. Time-based SQL injection is reliable but slower than union-based techniques; extracting large datasets may take considerable time, though it remains undetectable by signature-based monitoring. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but proof-of-concept material is likely to surface once the advisory gains visibility.

Remediation

Update the Photo Gallery by 10Web plugin to a patched version released after version 1.8.41. Vendors typically issue security patches within days of public disclosure. Additionally, audit WordPress contributor and author roles—remove inactive or untrusted accounts to reduce the attack surface. Review recent shortcode activity and database changes via database logs or WordPress security plugins to identify any stored malicious payloads. Consider implementing Web Application Firewall (WAF) rules to detect SQL injection attempts in AJAX handlers or shortcode parameters as a temporary compensating control.

Patch guidance

Monitor the official 10Web plugin repository and security advisories for version 1.8.42 or later (verify exact version numbers against the vendor advisory). Apply updates through the WordPress dashboard or via automated update mechanisms. Before updating, backup the database and test in a staging environment to ensure compatibility with custom shortcodes or themes that may depend on gallery functionality. If auto-updates are not enabled, prioritize this plugin in your patch schedule given the low privilege requirement and direct database exposure.

Detection guidance

Search WordPress database logs and server access logs for suspicious AJAX requests to 'shortcode_bwg' and 'bwg_frontend_data' handlers, especially those lacking the 'page' parameter or containing SQL keywords (UNION, SELECT, SLEEP, IF, CHAR, etc.) in POST parameters. Review the wp_posts or custom options tables for shortcode content containing encoded or obfuscated SQL. Use WordPress security plugins (e.g., Wordfence, Sucuri) configured to monitor AJAX activity and log database queries. Enable WordPress debug logging to wp-content/debug.log to capture suspicious queries. Endpoint detection and response (EDR) tools should flag processes executing unusual database queries from the web server process. Network-based intrusion detection signatures for time-based SQL injection may generate high false positives, so pair detection with behavioral analysis of database connections.

Why prioritize this

Despite a CVSS score of 6.5 (Medium), this vulnerability warrants high priority because: (1) the attack requires only contributor-level access, a common role in multi-user and agency environments; (2) successful exploitation directly exposes sensitive database records without user interaction; (3) the plugin is widely distributed and likely installed on many production WordPress sites; (4) no active mitigation is currently tracked in the KEV catalog, meaning security teams may not flag this immediately; and (5) once a payload is stored, it affects all site visitors, creating a persistent risk. Organizations with contributor-heavy WordPress installations or those handling sensitive data should patch within 48–72 hours.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability requiring low-privilege authentication, with no user interaction needed and high confidentiality impact but no integrity or availability impact. The score does not fully capture contextual risk: the low barrier to entry (contributor access) and widespread plugin adoption elevate practical risk beyond the numeric score. In environments with strict access controls and few contributors, the risk is lower; in multi-user or agency environments, it approaches a 7.5–8.0 practical severity.

Frequently asked questions