CVE-2022-0169: Photo Gallery by 10Web WordPress plugin unauthenticated SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection with CVSS 9.8, a public exploit reference and very high EPSS probability makes this an urgent patch.

What it is

The Photo Gallery by 10Web WordPress plugin before 1.6.0 fails to validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement through the bwg_frontend_data AJAX action. Because that action is reachable without authentication, any remote visitor can inject SQL into the plugin's queries. This is a critical flaw in a widely deployed WordPress plugin.

Impact

An attacker can read, modify or destroy database contents, including WordPress user credentials and site data, and may be able to pivot further depending on database privileges. Full compromise of confidentiality, integrity and availability is possible.

Attack surface

Reached over the network through the plugin's bwg_frontend_data AJAX endpoint, which the description states is available to unauthenticated and authenticated users. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.746 (99.5th percentile) and the WPScan reference is tagged Exploit, indicating public exploit detail exists. No ransomware association is documented.

What to do

• Update the Photo Gallery by 10Web plugin to version 1.6.0 or later immediately.
• If patching cannot be done at once, disable or remove the plugin until it can be updated.
• Deploy a web application firewall rule blocking or sanitizing the bwg_tag_id_bwg_thumbnails_0 parameter on the bwg_frontend_data AJAX action.
• Review database and WordPress accounts for signs of tampering and rotate credentials if compromise is suspected.
• Restrict database account privileges used by WordPress to the minimum needed.

Detection

• Search web server and WAF logs for requests to admin-ajax.php with action=bwg_frontend_data and suspicious bwg_tag_id_bwg_thumbnails_0 values containing SQL syntax.
• Monitor database query logs for UNION, SLEEP, BENCHMARK or other injection patterns originating from the web application.
• Alert on unexpected changes to WordPress users, options or plugin tables.
• Check for outbound connections or new administrative accounts created after suspicious AJAX activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.