SQL Injection Vulnerability in Gmedia Photo Gallery Plugin for WordPress

CVE-2026-96661

What is CVE-2026-96661?

The Gmedia Photo Gallery plugin for WordPress contains a SQL Injection vulnerability due to inadequate escaping of the 'gmedia__in' parameter in all versions up to and including 1.25.1. This flaw allows unauthenticated attackers to inject arbitrary SQL queries, potentially extracting sensitive data from the database. The vulnerability is exacerbated by the mobile app endpoint's lack of validation on feature flags, nonces, and authentication requirements, enabling direct exploitation without user accounts or sessions.

References