Unauthenticated SQL Injection in Gmedia Photo Gallery by Gmedia
CVE-2026-39785

9.3CRITICAL

Key Information:

Vendor

WordPress
Status
Gmedia Photo Gallery
Vendor
CVE Published:
6 October 2026

What is CVE-2026-39785?

An unauthenticated SQL Injection vulnerability exists in Gmedia Photo Gallery versions 1.25.1 and earlier. Attackers can exploit this flaw to execute arbitrary SQL commands, potentially gaining unauthorized access to sensitive data within the application. It is crucial for users of affected versions to apply the necessary updates to secure their installations and protect their information.

Affected Version(s)

Gmedia Photo Gallery 0 <= 1.25.1

References

https://patchstack.com/database/wordpress/plugin/grand-me...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Coopernicus | Patchstack Bug Bounty Program
.