Photo Gallery by 10Web: PHP Object Injection
Summary
The Photo Gallery by 10Web WordPress plugin up to and including version 1.8.46 contains a PHP object injection flaw (CWE-502). An attacker with a Contributor-level account can supply manipulated serialized data, which may let them change how the site processes data and run harmful actions on the server. Exploitation requires an authenticated Contributor account, so the flaw is not exploitable without login. Sites with multiple author accounts or open self-registration are most exposed.
Affected
- Photo Gallery by 10Web (WordPress plugin) up to and including 1.8.46
- Required privilege: Contributor
Fixed in
- Version 1.8.47 or later (Patchstack, WPScan). The latest release was not confirmed.
- A separate XSS issue is fixed in version 1.8.48 (WPScan).
Workaround
Unknown.
Exploitation
- Public exploit: none known (VulDB).
- Exploited in the wild: not known; not listed as known exploited (HOL, Strix).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Patchstack rates the flaw as medium priority and expects exploitation.
Our recommendation
- Update Photo Gallery by 10Web to the latest available version, at least 1.8.47.
- Until the update is applied, review Contributor-level accounts and remove those that are not needed.
- Deactivate the plugin on sites that do not need it.
- Check WordPress sites for unexpected accounts and monitor logs for suspicious activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- WPScan plugin entry: Photo Gallery wpscan.com
- VulDB CVE-2026-102377 advisory (412326) vuldb.com
- HOL Guard CVE-2026-102377 entry hol.org
- Strix CVE-2026-102377 entry www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:05.
Original description (NVD)
Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.