Contest Gallery CVE-2026-8912

Target must be running the Contest Gallery WordPress plugin at version 28.1.6 or earlier with at least one publicly accessible gallery page so the attacker can scrape the 'cg1l_action' / 'cg_nonce' value emitted to anonymous visitors; the vulnerable 'post_cg_gallery_form_upload' AJAX action must be reachable via /wp-admin/admin-ajax.php (the default for active WordPress plugins), and the attacker must drive the 'cb' branch of users-upload-check.php by supplying the relevant 'form_input' identifier. Limiting factors are minimal: no authentication, no user interaction, and no non-default configuration are required per CVSS PR:N/UI:N, but sites that have removed or gated all public gallery pages, deactivated the plugin, or front the site with a WAF that blocks this specific AJAX action are not exploitable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact and no integrity or availability impact, which aligns with a UNION/blind SQLi used for data exfiltration rather than data modification. The exposure of the gating nonce in public page source removes the typical 'nonce required' mitigating factor, so AC:L is justified. EPSS and CISA KEV data were not provided in the input, so exploitation probability and active-exploitation status cannot be quantified here; no public exploit identified at time of analysis. Practical risk is meaningful for any public WordPress site running Contest Gallery <= 28.1.6 because the prerequisites are minimal and the data on offer typically includes WordPress user records and form submissions; treat as a real priority for any internet-facing install while acknowledging EPSS/KEV signals are missing.

An attacker loads any public gallery page on the target WordPress site, scrapes the embedded 'cg1l_action' / 'cg_nonce' value from the HTML, and sends a crafted POST to /wp-admin/admin-ajax.php invoking 'post_cg_gallery_form_upload' with a SQL payload in 'form_input' that drives the 'cb' branch in users-upload-check.php. By appending UNION SELECT or boolean/time-based clauses to the unquoted $f_input_id concatenation, the attacker exfiltrates rows from wp_users (including password hashes and emails) and other tables, with no authentication and minimal complexity. No public exploit identified at time of analysis, though the trac line references make rediscovery straightforward.