CVE-2026-76006 Overview
The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress contains an authenticated SQL injection vulnerability in the s parameter. All versions up to and including 6.8.2 are affected. The flaw stems from insufficient escaping of user-supplied input combined with missing statement preparation on existing SQL queries. Authenticated attackers with administrator-level access can append additional SQL clauses to queries executed by the plugin. The vulnerability spans two distinct execution paths, enabling both blind and UNION-based data exfiltration from the WordPress database [CWE-89].
Critical Impact
Administrators on multi-admin WordPress sites can extract sensitive database content, including user credentials, session tokens, and private post data through crafted s parameter values.
Affected Products
- Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress
- All versions up to and including 6.8.2
- WordPress sites using the gallery-photo-gallery plugin
Discovery Timeline
- 2026-09-01 - CVE-2026-76006 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-76006
Vulnerability Analysis
The vulnerability resides in class-gallery-photo-gallery-categories-list-table.php, which handles category listing within the plugin's administrative interface. The s search parameter flows unsanitized into raw SQL statements executed against the WordPress database. Two code paths are affected: record_count() invokes $wpdb->get_var() with the tainted input, and prepare_items() together with get_image_categories() invokes $wpdb->get_results() with the same tainted input. Neither path calls $wpdb->prepare() with proper placeholders, and the code does not escape the parameter before concatenation. This construction allows attackers to break out of the intended query context and inject arbitrary SQL syntax.
Root Cause
The plugin concatenates the s request parameter directly into SQL query strings rather than parameterizing it. WordPress provides $wpdb->prepare() with %s and %d placeholders precisely to prevent this pattern. The absence of preparation on the existing query, combined with the lack of escaping via esc_sql() or equivalent, leaves the SQL grammar attacker-controllable at request time.
Attack Vector
An authenticated user with administrator privileges submits a crafted s parameter to the plugin's category list-table endpoint. Because the affected functions return values via get_var() and get_results(), the attacker can use UNION SELECT statements to exfiltrate arbitrary columns from any table the WordPress database user can read. Alternatively, boolean-based or time-based blind SQL injection techniques can extract data one bit at a time through the record_count() path. Exploitation requires administrator access, so the vector is most relevant on sites with multiple administrators, delegated agencies, or environments where a lower-privileged compromise has already achieved administrator escalation.
Technical details for the vulnerable code paths are available in the WordPress plugin source at line 63, line 224, line 226, line 234, and line 428.
Detection Methods for CVE-2026-76006
Indicators of Compromise
- Requests to wp-admin/admin.php referencing the Photo Gallery categories list-table with s parameter values containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or comment sequences like -- and /*.
- Unusually long or URL-encoded s parameter values submitted by administrator accounts.
- Database query log entries showing malformed or unexpected SELECT statements against plugin category tables.
Detection Strategies
- Inspect web server access logs for administrator-authenticated requests to the plugin containing SQL metacharacters in the s query string parameter.
- Enable WordPress database query logging or MySQL general query logging and alert on UNION SELECT patterns originating from the plugin's list-table handlers.
- Deploy a Web Application Firewall rule that inspects the s parameter on plugin admin endpoints for SQL injection payloads.
Monitoring Recommendations
- Monitor for anomalous administrator activity, including sudden bursts of category search requests or off-hours plugin admin access.
- Track outbound data volumes from the WordPress host to identify bulk extraction consistent with UNION-based exfiltration.
- Audit the WordPress wp_users and wp_usermeta tables for unauthorized reads by reviewing application-level access patterns.
How to Mitigate CVE-2026-76006
Immediate Actions Required
- Update the Photo Gallery by Ays – Responsive Image Gallery plugin to a version later than 6.8.2 once the vendor publishes a fixed release.
- Audit all WordPress administrator accounts and remove any that are unnecessary or dormant to shrink the exploitable population.
- Rotate WordPress secrets in wp-config.php and force password resets if unexplained administrator activity is discovered.
Patch Information
A plugin update addressing the vulnerable code paths is tracked in the WordPress plugin changeset. Additional analysis is available in the Wordfence vulnerability report.
Workarounds
- Deactivate the Photo Gallery by Ays plugin until a patched version is installed if the gallery functionality is not business-critical.
- Restrict administrator access to trusted personnel and enforce multi-factor authentication on all WordPress administrator accounts.
- Deploy a Web Application Firewall signature blocking SQL injection payloads in the s parameter on plugin admin endpoints.
- Apply the principle of least privilege to the MySQL database user backing WordPress so that INTO OUTFILE, LOAD_FILE, and cross-database reads are denied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
