EUVD-2026-58858
GHSA-c955-3f9v-xpgv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-delivered via AJAX, author credentials required (PR:L), no user interaction needed, scope unchanged, confidentiality-only impact with no write or DoS capability.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Contest Gallery - Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
Second-order SQL injection in the Contest Gallery WordPress plugin (all versions through 30.0.7) allows authenticated attackers with author-level access to append arbitrary SQL into backend queries via the cgRealId parameter within the cg_multiple_files_for_post upload mechanism. The injected payload is first stored in the database without adequate sanitization and later executed unsafely by backend AJAX handlers in ajax/ajax-functions-backend.php and gallery administration scripts, enabling extraction of sensitive information from the WordPress database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold an authenticated WordPress session with author-level access or higher (contributor, editor, administrator); unauthenticated exploitation is not possible given PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a realistic threat profile: exploitation is entirely remote and requires no user interaction, but does demand at minimum author-level WordPress credentials, which meaningfully limits the attacker surface to either compromised accounts or insider threats. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to update the Contest Gallery plugin beyond version 30.0.7. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today