CVE-2026-76006

Name of the Vulnerable Software and Affected Versions Photo Gallery by Ays – Responsive Image Gallery versions prior to 6.8.3

Description This issue is a generic SQL Injection that allows authenticated attackers with administrator-level access and above to append additional SQL queries to existing ones to extract sensitive information from the database. The flaw is caused by insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. The issue occurs via the s parameter and affects two execution paths: the record count() function using $wpdb->get var() and the prepare items()/get image categories() functions using $wpdb->get results(). This enables both blind and UNION-based exfiltration techniques, where blind exfiltration involves asking the database true/false questions and UNION-based exfiltration combines results from multiple queries into a single result set.

Recommendations Update to a version newer than 6.8.2. Avoid using the s parameter in the affected plugin functions until the update is applied.