Executive brief
The Contest Gallery plugin for WordPress, which is used to manage and display photo or video contests, contains a security flaw that allows unauthorized individuals to access sensitive database information. By exploiting this vulnerability, an attacker could potentially steal user data or other confidential site information without needing a password. This could lead to data breaches and compromise the privacy of contest participants and site administrators.
Technical details
The Contest Gallery plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'form_input' parameter in the 'post_cg_gallery_form_upload' AJAX action. The root cause is insufficient escaping and a lack of SQL preparation in the 'cb' branch of 'users-upload-check.php', where the '$f_input_id' variable is concatenated unquoted into a SELECT query. Although the endpoint is protected by a nonce, this nonce is publicly exposed in the page source of any gallery page, making the vulnerability accessible to unauthenticated remote attackers. Successful exploitation allows for the extraction of sensitive data from the WordPress database. The vulnerability is present in versions up to and including 28.1.6.
Affected products
- Contest Gallery Contest Gallery Up to and including 28.1.6
Timeline
- 2026-05-19: disclosed
- 2026-05-19: advisory
References
- https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/ajax/ajax-functions-frontend.php
- https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/functions/frontend/cg-general-frontend.php
- https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/v10/v10-frontend/user_upload/users-upload-check.php
- https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/v10/v10-frontend/user_upload/users-upload-check.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/71f2f8c4-00ee-4ab4-b0e0-9ddac46818b3?source=cve