CVE-2026-39785

CriticalCVSS 9.3

Published: 06/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

The Gmedia Photo Gallery (grand-media) plugin by Serhii Pasyuk contains an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. The vulnerability allows Blind SQL Injection and affects versions from n/a through 1.25.1.

Risk Assessment

An attacker can extract data from the WordPress database, including user and password information, potentially leading to site takeover.

Recommendation

Upgrade the Gmedia Photo Gallery plugin to a version later than 1.25.1 or disable it if no fix is available.

Other vulnerabilities in Gmedia Photo Gallery

CVE-2026-96661High
The Gmedia Photo Gallery plugin for WordPress up to version 1.25.1 is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter due to insufficient escaping and preparation, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS