Photo Gallery by 10Web <= 1.8.46 - Authenticated (Contributor+) PHP Object Injection via 'two_page_speed' Post Meta
- ID
- WPSEC-2026-0251
- Plugin
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery (photo-gallery)
- Affected
- from 1.8.3 before 1.8.47
- Remediation
- Update to 1.8.47 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Photo Gallery by 10Web on WPSec AttackSurface
- Fix released
- Published
Description
The Photo Gallery by 10Web plugin for WordPress is vulnerable to PHP Object Injection in versions 1.8.3 up to, and including, 1.8.46. The 'two_page_speed' post meta was registered without an authorization or sanitization callback, so any user who can edit a post can store a crafted serialized value in it through XML-RPC or the post editor's Custom Fields panel, and the plugin's admin bar code later passes every stored value to unserialize() on page loads by logged-in users. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP object. No POP chain is known in the plugin itself, but if one is present through another plugin or theme, an attacker could delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-0251/
- https://plugins.svn.wordpress.org/photo-gallery/tags/1.8.47/
- https://wordpress.org/plugins/photo-gallery/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS