CVE-2026-96661 pasyuk CVE debrief

Who should care

WordPress site administrators, defenders, and security teams should assess exposure and apply patches or mitigations to prevent potential exploitation of the SQL injection vulnerability in the Gmedia Photo Gallery plugin.

Why it matters

The Gmedia Photo Gallery plugin for WordPress has a high-severity SQL injection vulnerability that allows unauthenticated attackers to potentially extract sensitive information from the database. WordPress site administrators and defenders should assess exposure and apply patches or mitigations as a high priority.

• Potential extraction of sensitive information from the database.
• Possible disruption of database operations.
• Increased risk of data breaches.
• Need for verification of patch application and vulnerability remediation.

Technical summary

The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1. The vulnerability exists due to insufficient escaping on the user-supplied parameter and a lack of sufficient preparation on the existing SQL query. This allows unauthenticated attackers to append additional SQL queries into already existing queries, which can be used to extract sensitive information from the database.

Defensive priority

High priority for WordPress site administrators and defenders to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure by checking if the Gmedia Photo Gallery plugin version is 1.25.1 or earlier.
• Apply patches or updates provided by the vendor to fix the SQL injection vulnerability.
• Implement additional monitoring and logging to detect potential exploitation attempts.
• Review and restrict access to the mobile app endpoint to prevent unauthorized access.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The vulnerability is confirmed in Gmedia Photo Gallery versions up to and including 1.25.1. The unauthenticated mobile app endpoint's lack of validation for the Mobile App feature flag, nonce, or WordPress authentication allows for exploitation without credentials.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.