CVE-2026-9829 is a time-based SQL Injection vulnerability in the Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin affecting versions up to 1.8.41. The issue arises from improper neutralization of special elements in the 'compact_album_order_by' shortcode parameter, allowing authenticated attackers with contributor-level privileges to append SQL queries. The vulnerability is exploitable because the 'shortcode_bwg' AJAX handler accepts input without a valid nonce and stores the malicious payload, which can then be triggered by the unauthenticated 'bwg_frontend_data' AJAX handler. This flaw enables extraction of sensitive database information without requiring higher privileges or user interaction.

An attacker with contributor-level access can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact data integrity or availability directly but compromises confidentiality by allowing unauthorized data disclosure. No known exploits are reported in the wild at this time.

No official patch or remediation has been confirmed for this vulnerability as of the provided data. Users should monitor the vendor's advisory for updates. Until a fix is available, restricting contributor-level access and avoiding use of the affected plugin versions is recommended. Since the vulnerability requires contributor-level access, limiting user privileges can reduce risk.