What is the CVSS score of CVE-2026-40771?

CVE-2026-40771 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Contest Gallery are affected by CVE-2026-40771?

Your WordPress installations running the Contest Gallery plugin (versions ≤28.1.6) face a critical security breach risk from an unauthenticated database vulnerability allowing attackers to access or…

How to fix or mitigate CVE-2026-40771?

Within 24 hours: Audit all WordPress instances for Contest Gallery plugin versions ≤28.1.6; immediately disable or uninstall the affected plugin. Within 7 days: Review database access logs and transaction histories for exploitation indicators; validate database integrity and user permissions. Within 30 days: Evaluate alternative WordPress gallery solutions; implement Web Application Firewall (WAF) rules blocking SQL injection patterns for future defense-in-depth.

Contest Gallery CVE-2026-40771

EUVD-2026-36980 CRITICAL

SQL Injection (CWE-89)

2026-06-15 Patchstack

GHSA-w97c-mw8g-gjf8

SQLi Contest Gallery

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Remote unauthenticated SQLi (AV:N/AC:L/PR:N/UI:N); high confidentiality from data exfiltration, limited integrity via injected SQL, no availability impact, scope unchanged within WordPress DB context.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:11 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions.

AnalysisAI

Unauthenticated SQL injection in the Contest Gallery WordPress plugin (versions ≤28.1.6) allows remote attackers to inject arbitrary SQL into backend database queries without credentials or user interaction. The flaw was disclosed by Patchstack and tracked as EUVD-2026-36980; no public exploit identified at time of analysis, but the CVSS 9.3 score and PR:N attack vector make it a high-priority issue for any WordPress site running the plugin.

Technical ContextAI

Contest Gallery is a third-party WordPress plugin (CPE vendor 'wasiliy_strecker') used to run photo and media contests on WordPress sites. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input is concatenated into SQL statements executed against the WordPress MySQL/MariaDB database without proper parameterization or sanitization. Because WordPress plugins execute within the same database context as the core CMS, an injection in a plugin endpoint typically reaches the entire wp_* schema, including users, options, and posts tables.

RemediationAI

No vendor-released patch identified at time of analysis - the only reference points to the Patchstack advisory and does not cite a fixed version, so administrators should monitor https://patchstack.com/database/wordpress/plugin/contest-gallery/vulnerability/wordpress-contest-gallery-plugin-28-1-6-sql-injection-vulnerability and the plugin's wordpress.org page for a release above 28.1.6. Until a fixed version is published, the safest compensating control is to deactivate and remove the Contest Gallery plugin (side effect: any active contests, submission forms, and gallery shortcodes will stop rendering); if removal is not acceptable, place the affected plugin endpoints behind a WAF with SQLi signatures or restrict the contest-gallery URL paths to authenticated administrators via .htaccess or an access-control plugin (side effect: legitimate public contest submissions will be blocked). Subscribing to Patchstack's virtual patching feed is a reasonable interim control if available.