CVE-2026-102377
Deferred Deferred - Pending Action

PHP Object Injection in Photo Gallery by 10Web

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Patchstack

Description
Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-10-19
AI Q&A
2026-09-30
EPSS Evaluated
2026-10-18
NVD
CVE-2026-102377
EUVD
EUVD-2026-90223

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
10web photo_gallery to 1.8.46 (inc)
10web photo_gallery to 1.8.47 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a PHP Object Injection vulnerability in the WordPress Photo Gallery by 10Web plugin affecting versions 1.8.46 and earlier. Attackers with contributor-level access can exploit it to manipulate data processing and execute harmful actions on the server.

Detection Guidance

Detecting this PHP Object Injection vulnerability requires checking for vulnerable versions of the Photo Gallery by 10Web plugin. Use commands like 'wp plugin list' in WordPress to verify installed versions. If the version is 1.8.46 or earlier, the system is vulnerable. Patchstack also provides a mitigation rule to block attacks until the plugin is updated.

Impact Analysis

Exploitation could lead to severe server-side impacts including unauthorized code execution, data theft, or complete site compromise. Attackers may target thousands of websites in mass campaigns due to the vulnerability's ease of exploitation.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, potentially violating GDPR or HIPAA requirements for data protection and integrity. Exploitation may result in unauthorized data exposure or server compromise, which could breach compliance with these regulations.

Mitigation Strategies

Update the Photo Gallery by 10Web plugin to version 1.8.47 or later. Apply the mitigation rule provided by Patchstack to block attacks until the update is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102377. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart