Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.41 - Authenticated (Contributor+) SQL Injection
Description
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.8.41 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NTechnical Details
What Changed in the Fix
Changes introduced in v1.8.42
Source Code
WordPress.org SVN# Exploitation Research Plan - CVE-2026-49771 ## 1. Vulnerability Summary The **Photo Gallery by 10Web** plugin (versions <= 1.8.41) contains an authenticated SQL injection vulnerability. The flaw exists due to the plugin's failure to properly sanitize and prepare user-supplied parameters (likely s…
Show full research plan
Exploitation Research Plan - CVE-2026-49771
1. Vulnerability Summary
The Photo Gallery by 10Web plugin (versions <= 1.8.41) contains an authenticated SQL injection vulnerability. The flaw exists due to the plugin's failure to properly sanitize and prepare user-supplied parameters (likely sorting or filtering parameters) before incorporating them into SQL queries. Specifically, the ShortcodeController_bwg class in the admin interface calls data-fetching functions that utilize unvalidated request parameters in ORDER BY or WHERE clauses. Authenticated users with Contributor-level permissions or higher can exploit this to extract sensitive data from the WordPress database.
2. Attack Vector Analysis
- Endpoint:
/wp-admin/admin-ajax.php - AJAX Action:
shortcode_bwg(Registered inphoto-gallery.phpviawp_ajax_shortcode_bwg). - HTTP Method:
GETorPOST. - Vulnerable Parameters:
sort_byororder_by(inferred from typical 10Web patterns and the "Contributor+" context). - Authentication: Required (Contributor-level user).
- Nonce Requirement: Bypassable. The nonce check in
ShortcodeController_bwg::execute()is only triggered if thetaskparameter is non-empty AND thepageparameter equalsshortcode_bwg. By omitting these,
Summary
The Photo Gallery by 10Web plugin for WordPress is vulnerable to authenticated SQL Injection due to the lack of sanitization and preparation for parameters used in SQL ORDER BY clauses. Contributor-level users can inject malicious SQL fragments into shortcode attributes, which are then persisted and executed when the gallery is rendered on the site.
Vulnerable Code
// admin/controllers/Shortcode.php public function save() { global $wpdb; $tagtext = WDWLibrary::get('tagtext'); if ($tagtext) { /* clear tags */ $tagtext = " " . $tagtext; $id = WDWLibrary::get('currrent_id', 0, 'intval'); $insert = WDWLibrary::get('bwg_insert', 0, 'intval'); if (!$insert) { $wpdb->update($wpdb->prefix . 'bwg_shortcode', array( 'tagtext' => $tagtext ), array('id' => $id), array('%s'), array('%d')); } --- // frontend/models/model.php public function get_alb_gals_row( $bwg, $id, $albums_per_page, $sort_by, $order_by, $pagination_type = 0, $from = '' ) { $prepareArgs = array(); if ( $albums_per_page < 0 ) { $albums_per_page = 0; } global $wpdb; $order_by = 'ORDER BY `' . ( ( !empty( $from ) && $from === 'widget' ) ? 'id' : $sort_by ) . '` ' . $order_by; if ( $sort_by == 'random' || $sort_by == 'RAND()' ) { $order_by = 'ORDER BY RAND()'; }
Security Fix
@@ -11,7 +11,7 @@ public function execute() { $task = WDWLibrary::get('task'); - if ( $task != '' && $this->from_menu ) { + if ( $task != '' && ( $this->from_menu || $task === 'save' ) ) { if ( !WDWLibrary::verify_nonce(BWG()->nonce) ) { die('Sorry, your nonce did not verify.'); } @@ -58,6 +58,7 @@ global $wpdb; $tagtext = WDWLibrary::get('tagtext'); if ($tagtext) { + $tagtext = WDWLibrary::sanitize_shortcode_tagtext( $tagtext ); /* clear tags */ $tagtext = " " . $tagtext; $id = WDWLibrary::get('currrent_id', 0, 'intval'); @@ -3302,6 +3302,103 @@ } /** + * Whitelist sort direction for SQL ORDER BY (returns ASC or DESC). + * + * @param string $order_by + * + * @return string + */ + public static function sanitize_sort_direction( $order_by ) { + return ( strtolower( trim( (string) $order_by ) ) === 'asc' ) ? 'ASC' : 'DESC'; + } + + /** + * Whitelist album/gallery-group sort column for SQL ORDER BY. + * + * @param string $sort_by + * @param string $from + * + * @return string + */ + public static function sanitize_album_sort_column( $sort_by, $from = '' ) { + if ( !empty( $from ) && $from === 'widget' ) { + return 'id'; + } + $sort_by = trim( (string) $sort_by ); + if ( $sort_by === 'random' || $sort_by === 'RAND()' ) { + return 'random'; + } + $allowed_columns = array( 'order', 'name', 'modified_date', 'id' ); + return in_array( $sort_by, $allowed_columns, true ) ? $sort_by : 'order'; + } + + /** + * Whitelist image sort column for shortcode attributes. + * + * @param string $sort_by + * + * @return string + */ + public static function sanitize_image_sort_column( $sort_by ) { + $sort_by = trim( (string) $sort_by ); + if ( $sort_by === 'RAND()' ) { + return 'random'; + } + $allowed_columns = array( 'order', 'alt', 'date', 'filename', 'size', 'resolution', 'random', 'filetype' ); + return in_array( $sort_by, $allowed_columns, true ) ? $sort_by : 'order'; + } + + /** + * Sanitize sort/order attributes in shortcode tagtext before storage. + * + * @param string $tagtext + * + * @return string + */ + public static function sanitize_shortcode_tagtext( $tagtext ) { + $tagtext = trim( (string) $tagtext ); + if ( $tagtext === '' ) { + return ''; + } + $data = self::parse_tagtext_to_array( $tagtext ); + if ( empty( $data ) ) { + return $tagtext; + } + $album_group_sort_keys = array( + 'compact_album_sort_by', + 'masonry_album_sort_by', + 'extended_album_sort_by', + 'all_album_sort_by', + ); + $sanitized = ''; + foreach ( $data as $key => $value ) { + if ( in_array( $key, $album_group_sort_keys, true ) ) { + $value = self::sanitize_album_sort_column( $value ); + } + elseif ( preg_match( '/_order_by$/', $key ) || $key === 'order_by' ) { + $value = ( self::sanitize_sort_direction( $value ) === 'ASC' ) ? 'asc' : 'desc'; + } + elseif ( preg_match( '/_sort_by$/', $key ) || $key === 'sort_by' ) { + $value = self::sanitize_image_sort_column( $value ); + } + $sanitized .= ' ' . $key . '="' . self::escape_shortcode_attribute_value( $value ) . '"'; + } + + return $sanitized; + } + + /** + * Strip characters that break shortcode attribute quoting (preserves URLs and other content). + * + * @param string $value + * + * @return string + */ + public static function escape_shortcode_attribute_value( $value ) { + return str_replace( array( '"', "\0" ), '', (string) $value ); + } + + /** @@ -110,10 +110,14 @@ $albums_per_page = 0; } global $wpdb; - $order_by = 'ORDER BY `' . ( ( !empty( $from ) && $from === 'widget' ) ? 'id' : $sort_by ) . '` ' . $order_by; - if ( $sort_by == 'random' || $sort_by == 'RAND()' ) { + $sort_by = WDWLibrary::sanitize_album_sort_column( $sort_by, $from ); + $sort_direction = WDWLibrary::sanitize_sort_direction( $order_by ); + if ( $sort_by === 'random' ) { $order_by = 'ORDER BY RAND()'; } + else { + $order_by = 'ORDER BY `' . $sort_by . '` ' . $sort_direction; + } $search_where = ''; $search_value = trim( WDWLibrary::get( 'bwg_search_' . $bwg ) ); if ( !empty( $search_value ) ) {
Exploit Outline
The exploit target is the `shortcode_bwg` AJAX action. An authenticated attacker with at least Contributor permissions can bypass the plugin's weak nonce checks by omitting the `page` parameter in their request. The attacker sends a POST or GET request to `/wp-admin/admin-ajax.php` with `action=shortcode_bwg` and `task=save`. The payload is passed in the `tagtext` parameter, formatted as a shortcode with a malicious attribute (e.g., `sort_by="id`, (SELECT SLEEP(5))"`). This malicious attribute is saved to the plugin's shortcode metadata table. When the corresponding gallery is loaded on a page or via a post preview, the plugin parses the shortcode and passes the malicious `sort_by` string directly into a raw SQL query's `ORDER BY` clause in `get_alb_gals_row`, triggering the injection.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.