# CVE-2021-24139: Photo Gallery By 10Web - SQLi

> Live exploitation tracking for CVE-2021-24139 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-24139

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** 10Web Photo Gallery By 10Web
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** wordpress, cms

## Description

Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.

## CrowdSec analysis

[CVE-2021-24139](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-24139) is a critical SQL injection vulnerability in the Photo Gallery By 10Web WordPress plugin before version 1.5.55. Unvalidated input in the `bwg_search_x` parameter allows unauthenticated remote attackers to manipulate database queries, potentially exposing sensitive data, modifying website content, or compromising the affected WordPress site.

CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2021-24139 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target WordPress pages rendering the 10Web Photo Gallery plugin, identified through the `bwg_search_0` query parameter. Exploitation uses a time-based SQL injection payload containing `SLEEP(5)` and SQL comment obfuscation, causing delayed HTTP responses when the vulnerable parameter is processed.

## Timeline

- 2021-03-18: CVE Published. CVE-2021-24139 is published to NVD.
- 2026-08-25: Rule Released. CrowdSec releases a rule to detect CVE-2021-24139 exploitation attempts against the CrowdSec Network.
- 2026-10-11: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-24139 for the first time.

## References

- https://wpscan.com/vulnerability/2e33088e-7b93-44af-aa6a-e5d924f86e28
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24139.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-24139) follows observed exploitation activity for CVE-2021-24139. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.