What is the CVSS score of CVE-2026-57662?

CVE-2026-57662 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Contest Gallery are affected by CVE-2026-57662?

The Contest Gallery WordPress plugin (versions 30.0.0 and earlier) contains a SQL injection vulnerability that allows any contributor-level user to directly access your WordPress database contents,…

How to fix or mitigate CVE-2026-57662?

Within 24 hours: Inventory all WordPress installations using Contest Gallery plugin and document current versions; audit active Contributor-level user accounts. Within 7 days: Deactivate and uninstall the plugin if business-critical functionality permits, or restrict Contributor-level privileges to essential personnel only; enable database query logging and WAF SQL injection rules. Within 30 days: Monitor Patchstack and plugin vendor channels for patch release; coordinate upgrade testing and deployment plan.

Contest Gallery CVE-2026-57662

EUVD-2026-39667 HIGH

SQL Injection (CWE-89)

2026-06-26 audit@patchstack.com

GHSA-25p9-h7xj-6xhv

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Remote, low-complexity SQLi needing a Contributor account (PR:L, no UI); scope change to the WP database (S:C) yields high confidentiality, with limited integrity plausible for SQLi.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:45 vuln.today

DescriptionCVE.org

Contributor SQL Injection in Contest Gallery <= 30.0.0 versions.

AnalysisAI

SQL injection in the Contest Gallery WordPress plugin (versions <= 30.0.0) allows an authenticated user with Contributor-level access to inject arbitrary SQL through unsanitized input, exposing the contents of the WordPress database. The flaw was disclosed via Patchstack and carries a CVSS 8.5; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. The CVSS vector indicates a scope change (S:C), meaning the impact reaches beyond the vulnerable component into the underlying database.

Technical ContextAI

Contest Gallery is a WordPress plugin used to run photo and media contests with voting and submission galleries. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where user-supplied input reaches a database query without parameterization or proper escaping - a recurring class of bug in WordPress plugins that build queries against the shared WordPress MySQL/MariaDB database (wpdb). Because WordPress plugins execute within the site's PHP context and query the same database that stores users, credentials hashes, and post data, an injection here can read data far beyond the plugin's own tables, consistent with the CVSS scope change (S:C). No CPE string was provided in the input; affected scope is derived from the Patchstack advisory rather than an NVD CPE configuration.

RemediationAI

No vendor-released patch version is identified in the available data; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/contest-gallery/vulnerability/wordpress-contest-gallery-plugin-30-0-0-sql-injection-vulnerability?_s_id=cve) for the fixed release and upgrade to a version newer than 30.0.0 as soon as it is confirmed available. Until a patched version is applied, reduce exposure by tightening account provisioning: disable open user registration or ensure new registrations default to Subscriber rather than Contributor, and audit and remove untrusted Contributor-level accounts, since the flaw requires that privilege level - the trade-off is reduced ability for external contributors to submit content. As a compensating control, deploy a WordPress-aware WAF (Patchstack or equivalent) with a virtual patch / SQLi ruleset to filter malicious query parameters, accepting that WAF rules can produce false positives and are not a substitute for the code fix. If the plugin is not actively used, deactivate and remove it to eliminate the attack surface entirely.