Time-Based Blind SQL Injection in 10Web Photo Gallery Plugin for WordPress

CVE-2026-7048

What is CVE-2026-7048?

The Photo Gallery by 10Web plugin for WordPress has a vulnerability that enables authenticated users with contributor-level access or higher to perform time-based blind SQL injection attacks. This occurs through an insufficiently escaped 'order_by' parameter, allowing attackers to append malicious SQL queries to existing ones. By embedding crafted shortcodes within posts or drafts, malicious actors can extract sensitive information directly from the database during shortcode execution. Mitigating this risk requires immediate updates to ensure that the affected versions are patched.

References