CVE-2026-85652 Details
Description
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in all versions up to, and including, 1.8.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An Author-level user can store a SQL injection payload inside a published post's shortcode attribute, causing the payload to execute when any visitor renders the post; notably, the unsanitized value appears on both sides of a UNION query, potentially doubling the observable time-based delay.
A time-based SQL injection vulnerability has been identified in the Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress. This vulnerability exists in all versions through 1.8.44 and allows authenticated attackers with author-level access and above to exploit the 'album_id' shortcode attribute. The issue arises from inadequate escaping of user-supplied parameters and insufficient preparation of the SQL query, enabling attackers to inject additional SQL commands that could be used to extract sensitive database information. Notably, an author-level user can embed a SQL injection payload in a published post's shortcode attribute, triggering the payload's execution when the post is viewed. The unsanitized value is placed on both sides of a UNION query, potentially amplifying the observable time-based delay.
Users are advised to update the Photo Gallery by 10Web plugin to version 1.8.45 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 10Web Photo Gallery | <= 1.8.44 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |