Time-Based SQL Injection Vulnerability in Photo Gallery by 10Web

CVE-2026-85652

What is CVE-2026-85652?

The Photo Gallery by 10Web plugin for WordPress is exposed to a time-based SQL injection flaw through the 'album_id' shortcode attribute. This vulnerability stems from inadequate escaping of user-supplied data within the SQL queries, affecting all versions up to and including 1.8.44. Authenticated users with author-level access can exploit this flaw by injecting SQL queries into published posts, which are then executed when visitors render these posts. This exploit can lead to unauthorized access to sensitive database information.

References