CVE-2026-96661: Gmedia Photo Gallery SQL Injection Flaw

CVE-2026-96661 Overview

CVE-2026-96661 is a time-based SQL injection vulnerability in the Gmedia Photo Gallery (Grand Media) plugin for WordPress. The flaw affects all versions up to and including 1.25.1 and resides in the gmedia__in parameter. The plugin fails to properly escape user input and does not use prepared statements on the affected query. An unauthenticated mobile app endpoint dispatches the library action without checking the Mobile App feature flag, a nonce, or any WordPress authentication. Attackers can inject additional SQL into the existing query and extract sensitive data from the WordPress database [CWE-89].

Critical Impact
Unauthenticated remote attackers can extract sensitive data, including credentials and user information, from the WordPress database without any user interaction.

Affected Products

Gmedia Photo Gallery (Grand Media) plugin for WordPress
All versions up to and including 1.25.1
WordPress sites with the plugin's mobile app endpoint reachable

Discovery Timeline

2026-10-14 - CVE-2026-96661 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-96661

Vulnerability Analysis

The vulnerability stems from unsanitized input flowing into a SQL statement constructed in the plugin's database layer. The gmedia__in parameter is accepted from the request and concatenated into the query without escaping or parameter binding. Attackers trigger the condition through an unauthenticated mobile app endpoint that routes to the library action.

Because the response does not directly reflect query output, exploitation relies on time-based inference. Attackers inject conditional SLEEP() payloads and measure response delays to extract data one bit at a time. Successful exploitation discloses sensitive data such as administrator password hashes, session tokens, and WordPress secrets stored in the wp_options and wp_users tables.

Root Cause

Two defects combine to produce the vulnerability. First, the SQL query at inc/db.connect.php lines 1682 and 2206 concatenates the gmedia__in value without using $wpdb->prepare() or esc_sql(). Second, the access check at app/access.php dispatches the library action without validating the Mobile App feature flag, a WordPress nonce, or an authenticated user session.

Attack Vector

The attack is remote and unauthenticated. An attacker sends a crafted HTTP request to the plugin's mobile app endpoint with a malicious gmedia__in payload containing time-delay SQL functions. No account, cookie, or nonce is required. The attacker iterates requests and infers database contents from response timing differences.

Technical references for the vulnerable code paths are available in the WordPress Grand Media db.connect.php source, the access.php dispatcher source, and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-96661

Indicators of Compromise

HTTP requests to the Gmedia mobile app endpoint containing the gmedia__in parameter with SQL keywords such as SLEEP, BENCHMARK, SELECT, UNION, or IF(
Repeated requests from the same source IP with incrementing payload variations characteristic of blind SQL injection enumeration
Elevated database response times correlated with inbound requests to the plugin endpoint
Web server access logs showing unauthenticated POST or GET requests dispatching the plugin library action

Detection Strategies

Deploy web application firewall rules that identify SQL injection patterns in the gmedia__in request parameter
Baseline normal request timing to the plugin endpoint and alert on sustained response delays matching SLEEP() injection
Correlate web access logs with database slow query logs to identify timing-based exfiltration attempts

Monitoring Recommendations

Enable verbose logging on WordPress endpoints that handle the Gmedia plugin requests
Monitor for repeated unauthenticated access to app/access.php dispatch routes
Alert on anomalous outbound data volumes or sudden spikes in request count against the plugin

How to Mitigate CVE-2026-96661

Immediate Actions Required

Deactivate and remove the Gmedia Photo Gallery plugin on any WordPress site running version 1.25.1 or earlier until a patched release is applied
Block requests containing the gmedia__in parameter at the WAF or reverse proxy layer
Rotate WordPress administrator credentials, API keys, and authentication salts if exploitation is suspected
Audit wp_users and wp_options tables for unauthorized modifications

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. Monitor the Wordfence Vulnerability Report and the plugin repository for a patched release that introduces proper use of $wpdb->prepare() and adds authentication, nonce, and feature flag checks to the mobile app endpoint.

Workarounds

Restrict access to the plugin's mobile app endpoint using server-level access controls or IP allow-lists
Deploy WAF signatures that block SQL metacharacters and time-delay functions in the gmedia__in parameter
Place the WordPress site behind an authenticated reverse proxy if the mobile app functionality is not required

bash

# Example nginx rule to block requests containing SQL time-delay payloads targeting gmedia__in
if ($args ~* "gmedia__in=.*(sleep|benchmark|union|select)") {
    return 403;
}