Contest Gallery CVE-2026-16586

Exploitation requires the attacker to hold an authenticated WordPress session with author-level access or higher (contributor, editor, administrator); unauthenticated exploitation is not possible given PR:L in the CVSS vector. The Contest Gallery plugin must be installed and network-active on the target WordPress instance, and the multiple-files-for-post upload feature (cg_multiple_files_for_post) must be accessible to the attacker's role. The second-order nature requires a two-phase interaction: the attacker must first submit the malicious cgRealId payload through the upload path, and the payload must subsequently be retrieved and processed by one of the identified backend AJAX handlers or gallery administration scripts. No non-default server or PHP configuration is required beyond the plugin being active. Exploitation is limited to data exfiltration from the WordPress database (C:H); no write or denial-of-service capability is indicated by the CVSS vector.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a realistic threat profile: exploitation is entirely remote and requires no user interaction, but does demand at minimum author-level WordPress credentials, which meaningfully limits the attacker surface to either compromised accounts or insider threats. The confidentiality impact is high - an attacker can enumerate the entire WordPress database, potentially harvesting credentials, PII, payment metadata, or API keys stored by other plugins. Integrity and availability are unaffected. EPSS data was not provided in the input and cannot be stated; KEV status is absent, meaning no confirmed in-the-wild exploitation has been catalogued by CISA. No POC code was included in the intelligence package. The second-order nature of the injection adds complexity: an attacker must execute two phases (store payload, then trigger the vulnerable retrieval path), which slightly raises the practical bar compared to a direct injection. Even a mid-sized municipal IT team in bytom running a public photo-contest microsite on WordPress should treat this as a meaningful internal-threat vector if contributor or author accounts are broadly provisioned, while externally-facing risk remains conditional on credential access. The CVSS score of 6.5 (Medium) appears well-calibrated given the authentication requirement.

An attacker who has obtained or registered a WordPress author account on a target site submits a specially crafted cgRealId value within the cg_multiple_files_for_post parameter - embedding SQL payloads that appear benign at the storage stage and bypass first-phase validation. When a site administrator or the plugin's own backend AJAX routine later retrieves and processes the stored file association record, the unsafe SQL construction executes the attacker's injected clause, returning sensitive database rows such as WordPress user password hashes, stored API tokens, or PayPal/Stripe configuration data to the attacker via the AJAX response. No public proof-of-concept code has been identified at time of analysis.