# CVE-2026-8912: Contest Gallery SQL injection in form_input parameter

Source: https://junglewise.ai/threats/cve-2026-8912-contest-gallery-sql-injection-in-form-input-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-19. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-8912 · Severity: high · CVSS 7.5 · Published 2026-05-19

The Contest Gallery plugin for WordPress, which is used to manage and display photo or video contests, contains a security flaw that allows unauthorized individuals to access sensitive database information. By exploiting this vulnerability, an attacker could potentially steal user data or other confidential site information without needing a password. This could lead to data breaches and compromise the privacy of contest participants and site administrators.

Technologies: [Contest Gallery](https://junglewise.ai/threats/technologies/contest-gallery). Vendors: [Contest Gallery](https://junglewise.ai/threats/vendors/contest-gallery).

## Quick answers

**Is CVE-2026-8912 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8912 being exploited in the wild.

**How severe is CVE-2026-8912?** High severity, with a CVSS score of 7.5, published 19 May 2026.

**Which products and versions are affected?** Contest Gallery Up to and including 28.1.6.

**Is there a fix for CVE-2026-8912?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8912 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8912?** Check whether you run Contest Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Contest Gallery plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'form_input' parameter in the 'post_cg_gallery_form_upload' AJAX action. The root cause is insufficient escaping and a lack of SQL preparation in the 'cb' branch of 'users-upload-check.php', where the '$f_input_id' variable is concatenated unquoted into a SELECT query. Although the endpoint is protected by a nonce, this nonce is publicly exposed in the page source of any gallery page, making the vulnerability accessible to unauthenticated remote attackers. Successful exploitation allows for the extraction of sensitive data from the WordPress database. The vulnerability is present in versions up to and including 28.1.6.

## Affected products

- Contest Gallery Contest Gallery Up to and including 28.1.6

## Timeline

- 2026-05-19: disclosed
- 2026-05-19: advisory

## References

- [https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/ajax/ajax-functions-frontend.php](https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/ajax/ajax-functions-frontend.php)
- [https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/functions/frontend/cg-general-frontend.php](https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/functions/frontend/cg-general-frontend.php)
- [https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/v10/v10-frontend/user_upload/users-upload-check.php](https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/v10/v10-frontend/user_upload/users-upload-check.php)
- [https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/v10/v10-frontend/user_upload/users-upload-check.php](https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/v10/v10-frontend/user_upload/users-upload-check.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/71f2f8c4-00ee-4ab4-b0e0-9ddac46818b3?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/71f2f8c4-00ee-4ab4-b0e0-9ddac46818b3?source=cve)

## Related threats

- [Contest Gallery WordPress plugin vote restriction bypass](https://junglewise.ai/threats/cve-2026-107447-the-contest-gallery-wordpress-plugin-before-34-0-1-does-not)
- [Contest Gallery WordPress plugin missing authorization in OpenAI prompt handler](https://junglewise.ai/threats/cve-2026-16056-contest-gallery-wordpress-plugin-missing-authorization-in-openai)
- [Contest Gallery WordPress plugin privilege escalation](https://junglewise.ai/threats/cve-2026-12165-contest-gallery-wordpress-plugin-privilege-escalation)
- [Contest Gallery improper input validation in WordPress plugin](https://junglewise.ai/threats/cve-2026-42657-contest-gallery-improper-input-validation-in-wordpress-plugin)