Gmedia Photo Gallery WordPress plugin: Blind SQL injection
Summary
The WordPress plugin Gmedia Photo Gallery (grand-media) up to and including version 1.25.1 contains a blind SQL injection vulnerability (CVE-2026-39785, CVSS 9.3). An unauthenticated remote attacker can send crafted requests to read data from the WordPress database, including user accounts and private data, and may be able to modify or delete data. Patchstack reports version 1.25.2 as patched, but no vendor advisory or changelog entry confirming this fix could be verified.
Affected
- Gmedia Photo Gallery (WordPress plugin grand-media) up to and including 1.25.1
- Earlier versions: lower bound not specified in the CNA record (listed as 0 to <= 1.25.1)
Fixed in
- Patchstack lists version 1.25.2 as the patched version (not confirmed by the vendor or WordPress.org changelog)
- Vendor fix status: Unknown.
Workaround
- No vendor mitigation documented.
- Patchstack has issued a virtual-patch rule for its customers; check its status.
- Restrict public access to the affected site or plugin endpoints where possible.
Exploitation
- Not known exploited; not listed in CISA KEV as far as could be verified.
- No public proof of concept found in the research; this does not rule out that one exists.
- CISA SSVC: Automatable yes, technical impact partial.
- Patchstack describes the flaw as highly dangerous and expected to be exploited in mass campaigns.
Our recommendation
- Check whether any WordPress site uses Gmedia Photo Gallery (grand-media), especially internet-facing sites.
- Deactivate and remove the plugin if the gallery is not business-critical; this is the most reliable option as no vendor fix is confirmed.
- If the plugin must stay, update to 1.25.2 only after verifying the release, apply a WAF or virtual patch, and restrict the database account privileges.
- Create a tested backup and review web logs for unusual requests to the plugin or the gmedia__in parameter.
- Plan migration to a maintained gallery plugin, as the plugin may be abandoned.
- Note the overlapping CVE-2026-96661 and check it as well.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-39785 patchstack.com
- Strix CVE-2026-39785 www.strix.ai
- HOL CVE-2026-39785 hol.org
- WPScan vulnerability record wpscan.com
- Strix CVE-2026-96661 (overlapping CVE) www.strix.ai
- WordPress.org Grand Media plugin page wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:21.
Original description (NVD)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.