CVE-2026-96661

Name of the Vulnerable Software and Affected Versions Gmedia Photo Gallery versions prior to 1.25.2

Description The plugin is subject to time-based SQL Injection, a technique where an attacker sends a query that forces the database to wait a specific amount of time before responding, allowing them to infer data. This occurs due to insufficient escaping of user-supplied input and lack of preparation in the SQL query. Unauthenticated attackers can append malicious SQL queries to extract sensitive information from the database. The issue is accessible via the unauthenticated mobile app endpoint, which executes the library action without validating the Mobile App feature flag, a nonce, or WordPress authentication, requiring no account or session for exploitation. The vulnerable parameter is gmedia in.

Recommendations Update Gmedia Photo Gallery to version 1.25.2 or later. Restrict access to the mobile app endpoint to minimize the risk of exploitation.