CVE-2022-0169

What it actually does

CVE-2022-0169 is an unauthenticated SQL injection vulnerability in the Photo Gallery by 10Web WordPress plugin before version 1.6.0. The plugin fails to properly validate and escape the `bwg_tag_id_bwg_thumbnails_0` parameter before using it in a SQL query through the `bwg_frontend_data` AJAX action, which is reachable by both unauthenticated and authenticated users. Because the attack vector is network-accessible, requires no privileges, and needs no user interaction, an attacker can potentially read, modify, or delete database contents, including WordPress user records and application data. Depending on database permissions and server configuration, exploitation may also support authentication bypass, administrator account creation, data exfiltration, site defacement, or further compromise of the WordPress installation.

Why it matters to the business

Successful exploitation can lead to full compromise of a WordPress site using a vulnerable version of the Photo Gallery by 10Web plugin. Business consequences may include theft of customer or user data, unauthorized administrative access, website defacement, malicious redirects, SEO spam, malware injection, downtime, regulatory notification obligations, and loss of trust. The high CVSS score, weaponized exploit maturity, and elevated EPSS score indicate a meaningful likelihood of opportunistic exploitation against internet-facing WordPress sites, even though the vulnerability is not currently listed in CISA KEV.

How an attack unfolds

An attacker identifies a WordPress site running a vulnerable version of the Photo Gallery by 10Web plugin. They send a crafted HTTP request to the WordPress AJAX endpoint invoking the `bwg_frontend_data` action and place SQL injection payloads in the `bwg_tag_id_bwg_thumbnails_0` parameter. Because the plugin does not adequately validate or escape this parameter before including it in a SQL statement, the database executes attacker-controlled SQL logic. The attacker can then enumerate database metadata, extract sensitive records such as user accounts and password hashes, modify content, create or elevate WordPress users, or tamper with plugin and site data. In a post-exploitation phase, the attacker may log in using stolen or planted credentials, upload a malicious plugin or theme, add a PHP web shell, inject JavaScript into pages, or use the compromised site for spam, phishing, or malware distribution.

How to fix it

Upgrade the Photo Gallery by 10Web WordPress plugin to version 1.6.0 or later. If an updated version is unavailable from the normal update channel, disable and remove the plugin until a fixed release can be installed. Restrict public access to WordPress AJAX functionality where feasible using a web application firewall, but do not rely on WAF rules as the primary fix. Review database user permissions to ensure the WordPress database account does not have unnecessary privileges beyond the application’s needs. After patching, rotate WordPress administrator passwords, review administrator accounts, and consider resetting salts and active sessions if exploitation is suspected. Maintain current backups and verify that restoration points predate any suspected compromise.

How to confirm the fix worked

Confirm that the installed Photo Gallery by 10Web plugin version is 1.6.0 or later by checking the WordPress admin plugin page, the plugin metadata file, or package inventory. Verify that no vulnerable copy remains in inactive plugin directories, staging copies, backup web roots, or duplicated WordPress installations. Test exposure by confirming unauthenticated requests to `/wp-admin/admin-ajax.php` with `action=bwg_frontend_data` no longer allow SQL control through `bwg_tag_id_bwg_thumbnails_0`; this should be done in a controlled, non-destructive manner. Review WAF, reverse proxy, and web server logs for prior suspicious requests to the vulnerable AJAX action. If any evidence of exploitation exists, validate integrity of WordPress users, plugin/theme files, database content, scheduled tasks, and public pages.

Typical attack path

1. Scan the internet for WordPress sites exposing the Photo Gallery by 10Web plugin or related plugin assets.
2. Confirm the plugin is present and potentially below version 1.6.0 by checking public plugin files, page source, asset URLs, or WordPress metadata.
3. Send crafted requests to `/wp-admin/admin-ajax.php` using the `action=bwg_frontend_data` parameter.
4. Inject SQL payloads into the `bwg_tag_id_bwg_thumbnails_0` parameter to confirm database error behavior, boolean differences, or time-based delays.
5. Enumerate database structure and extract sensitive data such as WordPress users, password hashes, emails, session-related values, or plugin data.
6. Modify database records to create an administrator account, change user credentials, inject malicious content, or alter site configuration.
7. Use gained access to deploy persistence, such as a malicious plugin, theme modification, PHP web shell, rogue administrator account, or injected JavaScript.
8. Cover tracks by deleting suspicious files, modifying timestamps, removing temporary accounts, or reducing obvious log artifacts.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs from the web server, CDN, WAF, and reverse proxy for requests to `/wp-admin/admin-ajax.php` where `action=bwg_frontend_data` is present with the `bwg_tag_id_bwg_thumbnails_0` parameter. Focus on suspicious SQL syntax, URL-encoded SQL keywords, time-delay functions, comment delimiters, UNION-based extraction, boolean tests, and unusually long parameter values. Correlate suspicious requests with database logs, PHP error logs, WordPress debug logs, authentication logs, and file modification timestamps. Look for subsequent creation of administrator users, password changes, changes to `wp_options`, injected scripts in posts or pages, unfamiliar plugins, modified theme files, unexpected PHP files in upload directories, or outbound connections from the web server. Because exploit maturity is weaponized and EPSS is high, absence of a KEV listing should not be treated as low risk. If SQL injection probes are found, assume credentials or database contents may have been exposed until forensic review proves otherwise.

• /wp-admin/admin-ajax.php
• action=bwg_frontend_data
• bwg_tag_id_bwg_thumbnails_0
• bwg_frontend_data&bwg_tag_id_bwg_thumbnails_0=
• bwg_tag_id_bwg_thumbnails_0%3D
• UNION SELECT
• UNION%20SELECT
• UNION+SELECT
• SLEEP(
• SLEEP%28
• BENCHMARK(
• BENCHMARK%28
• information_schema
• information_schema.tables
• information_schema.columns
• concat(
• concat%28
• group_concat(
• group_concat%28
• @@version
• database()
• database%28%29
• user()
• user%28%29
• or 1=1
• OR%201%3D1
• and 1=1
• AND%201%3D1
• -- -
• #
• /*
• */
• /wp-content/plugins/photo-gallery/
• /wp-content/uploads/*.php

What your security team should do

• Prioritize patching internet-facing WordPress sites running Photo Gallery by 10Web because exploitation is unauthenticated, low-complexity, and weaponized.
• Upgrade the plugin to version 1.6.0 or later, or disable and remove it if patching cannot be completed immediately.
• Search web server, WAF, CDN, and WordPress logs for requests to `/wp-admin/admin-ajax.php` containing `action=bwg_frontend_data` and `bwg_tag_id_bwg_thumbnails_0`.
• Investigate any SQL injection-style payloads, time-delay functions, UNION queries, encoded payloads, or repeated probing against the vulnerable parameter.
• Audit WordPress administrator accounts for newly created, unexpected, or recently modified users.
• Inspect plugin and theme directories for recently changed PHP files, unauthorized uploads, web shells, or obfuscated code.
• Rotate credentials and invalidate sessions if exploitation is suspected, including WordPress administrator passwords, database credentials where practical, and application salts.
• Deploy or tune WAF rules to block SQL injection attempts against WordPress AJAX endpoints as a compensating control.
• Ensure backups are available and verify that clean restore points exist before any suspected compromise window.
• Add the plugin to vulnerability management and software inventory checks so outdated installations are continuously detected.