CVE-2026-85652 is a time-based SQL Injection vulnerability in the Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin. It affects all versions up to and including 1.8.44. The vulnerability is due to improper neutralization of special elements in SQL commands (CWE-89), specifically insufficient escaping of the 'album_id' shortcode attribute and lack of prepared statements. Authenticated users with author-level privileges can inject SQL payloads into published posts, which execute when the post is viewed, allowing extraction of sensitive database information. The injection is notable because the unsanitized value appears on both sides of a UNION query, potentially doubling the observable time delay used in the attack.

An attacker with author-level access or higher can exploit this vulnerability to perform time-based SQL Injection attacks, enabling them to extract sensitive information from the database. The vulnerability does not allow direct modification or deletion of data (no integrity or availability impact indicated), but it compromises confidentiality by leaking sensitive data. The attack requires authenticated access, limiting the threat to users with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict author-level access to trusted users only and consider disabling or removing the vulnerable plugin. Monitor for updates from 10Web regarding an official fix and apply it promptly once released.