CVE-2026-49771: WordPress Photo Gallery by 10Web plugin <= 1.8.41 - SQL Injection vulnerability

Synopsis

SQL injection vulnerability in the Photo Gallery by 10Web WordPress plugin (versions through 1.8.41) allows an authenticated attacker with administrator-level credentials to reach the flaw over the network without any victim interaction. Exploitation enables blind SQL injection against the underlying database, disclosing sensitive data stored there and causing limited service disruption. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available as soon as a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress installation over the network; the vulnerable plugin endpoint is exposed via standard HTTP/HTTPS.

• AuthenticationRequired

  An admin-level (high-privilege) WordPress account is required; the vulnerability is not reachable by unauthenticated or low-privilege users.

• Victim interactionNot required

  No victim interaction is needed; the attacker submits crafted SQL payloads directly to the plugin endpoint without involving another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental prerequisites.

Blast Radius

• Reads data from the WordPress database, including user credentials, stored session tokens, and any customer or content records managed by the site.
• Database contents outside the WordPress schema may also be enumerated if the database user has broad privileges, expanding the disclosure surface beyond the plugin's own tables.
• Availability of the affected service is partially degraded by resource-intensive blind injection queries, which can slow or intermittently disrupt database responsiveness.