CVE-2026-85652 10web CVE debrief

Who should care

WordPress administrators, security teams, and users with author-level access or higher should assess exposure and apply patches. Additionally, users with elevated access levels, such as administrators, should verify if author-level access or higher is present in the WordPress environment and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-85652 is a time-based SQL Injection vulnerability in the Photo Gallery plugin for WordPress. Authenticated attackers with author-level access can inject SQL queries, potentially extracting sensitive database information. WordPress administrators and security teams should assess exposure and apply patches.

• Potential extraction of sensitive database information by authenticated attackers.
• Possible disruption of database operations due to injected SQL queries.
• Increased risk of data breaches due to insufficient escaping of user-supplied parameters.
• Need for verification of plugin versions and user access levels to prevent exploitation.

Technical summary

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'album_id' Shortcode Attribute. This allows authenticated attackers with author-level access to append additional SQL queries to existing queries, potentially extracting sensitive information from the database. The vulnerability has a CVSS score of 6.5 and a severity of MEDIUM. The payload can be stored in a published post's shortcode attribute and executed when any visitor renders the post. The vulnerability affects all versions up to, and including, 1.8.44.

Defensive priority

Medium priority for WordPress administrators and security teams to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by checking if the Photo Gallery plugin version is 1.8.44 or earlier.
• Verify if author-level access or higher is present in the WordPress environment.
• Apply patches or updates to the plugin as soon as available.
• Monitor for suspicious SQL query activity in the WordPress database.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability allows authenticated attackers with author-level access to inject SQL queries via the 'album_id' Shortcode Attribute. The payload can be stored in a published post's shortcode attribute and executed when any visitor renders the post.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.