SQL Injection Vulnerability in Photo Gallery by 10Web for WordPress

CVE-2026-9829

What is CVE-2026-9829?

The Photo Gallery by 10Web plugin for WordPress is susceptible to an SQL Injection vulnerability through the 'compact_album_order_by' shortcode parameter. This issue arises from inadequate escaping of user-supplied input, allowing authenticated attackers with contributor-level access to inject additional SQL queries. The vulnerability facilitates the extraction of sensitive data from the database by leveraging the 'shortcode_bwg' AJAX handler, which can be triggered by malicious contributors without a valid nonce. This exploit emphasizes the need for proper input validation and query preparation to safeguard against unauthorized data exposure.

References