This vulnerability (CVE-2026-49771) in 10Web Photo Gallery arises from improper neutralization of special elements in SQL commands, classified under CWE-89. It enables Blind SQL Injection attacks, which can allow an attacker with high privileges to extract sensitive data from the database without direct visibility of query results. The CVSS 3.1 score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and a scope change with high confidentiality impact, no integrity impact, and low availability impact. The affected versions include all up to 1.8.41. No patch or official remediation is currently documented.

An attacker with high privileges can exploit this vulnerability to perform Blind SQL Injection, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). Integrity is not impacted, and availability impact is low. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict high-privilege access to the affected plugin and monitor for updates from 10Web. No vendor-provided mitigations or temporary fixes are currently available.