Live Active security incident? Get immediate response
CVE Record

CVE-2026-9829: Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'compact_album_order_by' Shortcode Parameter in all versions up to, and including, 1.8.41 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The malicious payload is stored via the 'shortcode_bwg' AJAX handler — accessible to Contributor-level users and exploitable without a valid nonce by omitting the 'page' parameter — and is subsequently triggered by the unauthenticated 'bwg_frontend_data' AJAX handler, meaning successful exploitation requires only that an attacker has Contributor-level access to save the shortcode.

MediumCVSS 6.5Not KEV-listed Updated
Discuss exposure Back to CVEs
Glexia's Take moderate

Analyst readout for executives and security teams

Plain-English summary

This vulnerability affects the Photo Gallery by 10Web WordPress plugin through version 1.8.41. A logged-in user with Contributor privileges or higher could cause the site database to reveal sensitive information. It is not listed as actively exploited in CISA KEV, but sites allowing many authors or shared accounts have higher risk.

Executive priority

Prioritize remediation for public WordPress sites with multiple content contributors or weak account controls. For tightly controlled sites with only trusted administrators, urgency is lower but still warrants patch tracking because the impact is sensitive database disclosure.

Technical view

CVE-2026-9829 is a time-based SQL injection in the compact_album_order_by shortcode parameter. Sources state insufficient escaping and query preparation allow authenticated Contributor+ users to store malicious shortcode data through an AJAX handler, later triggered through an unauthenticated frontend AJAX handler. CVSS is 6.5 with high confidentiality impact.

Likely exposure

Exposure is limited to WordPress sites running Photo Gallery by 10Web versions up to and including 1.8.41, especially where Contributor-level users are untrusted, compromised, or broadly provisioned. Public visitors alone are not enough to plant the vulnerable shortcode according to the provided description.

Exploitation context

The issue requires low-privileged authenticated access to save the shortcode. After storage, triggering occurs through a frontend AJAX path. No provided source or KEV status confirms active exploitation. The main business concern is database confidentiality, including possible exposure of WordPress data accessible through SQL queries.

Researcher notes

The source bundle identifies CWE-89 and a specific shortcode parameter path. The affected range is stated as all versions up to 1.8.41. A WordPress.org changeset is referenced, but the bundle does not clearly name a fixed version. Avoid assuming exploitation in the wild without additional evidence.

Mitigation direction

  • Update the plugin when a vendor-fixed release is available through WordPress or 10Web guidance.
  • Review the referenced WordPress.org changeset and vendor advisory for fix availability.
  • Restrict Contributor and higher roles to trusted users only.
  • Remove unused author accounts and rotate credentials for suspicious accounts.
  • Monitor web application firewall or WordPress security logs for related AJAX abuse.

Validation and detection

  • Inventory WordPress sites using Photo Gallery by 10Web.
  • Confirm plugin version; treat versions through 1.8.41 as affected.
  • Review user lists for Contributor, Author, Editor, and Administrator accounts.
  • Check whether recent plugin updates include the referenced repository changeset.
  • Inspect logs for unusual shortcode-saving or frontend AJAX activity.
Prepared
Confidence
high
Sources
9

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-89: Database access and collection lookup

Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-9829 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profile CVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1 CVSS vectors
5 Timeline events
1 ADP providers
11 Source links

SSVC decision data

CISA-ADP CISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

Score Version Severity Vector Exploit Impact Source
6.5 CVSS 3.1 Medium CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 2.8 3.6 Wordfence

Vulnerability scoring details

Base CVSS 3.1 score

6.5 Medium
CVSS 3.1 vector shape for CVE-2026-9829 Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reserved CVE Program

    The CVE ID was reserved by the assigning CNA.

  2. Source timeline Wordfence

    Vendor Notified

  3. Source timeline Wordfence

    Disclosed

  4. CVE published CVE Program

    The CVE record was published.

  5. CVE updated CVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADP CISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

Vendor Product Version / package Status
10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery 0 unaffected
Weakness

CWE details

CWE-89

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-89 · source CWE mapping

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligence Same-CWE CVEs