What is the CVSS score of EUVD-2026-30893?

EUVD-2026-30893 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Contest Gallery are affected by EUVD-2026-30893?

Contest Gallery WordPress plugin (through version 28.1.6) contains an unauthenticated SQL injection vulnerability in its public gallery upload endpoint, with no public exploit identified at time of…

How to fix or mitigate EUVD-2026-30893?

24 hours: Identify all WordPress sites using Contest Gallery plugin and document versions in use. 7 days: Disable the plugin entirely or implement Web Application Firewall rules to block the vulnerable POST action at admin-ajax.php with the 'post_cg_gallery_form_upload' parameter. 30 days: Monitor Wordfence security advisories for patched versions; apply immediately upon release.

Contest Gallery EUVD-2026-30893

| CVE-2026-8912 HIGH

SQL Injection (CWE-89)

2026-05-19 Wordfence

GHSA-7v7x-p7vg-p2vc

WordPress PHP SQLi

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 13:00 vuln.today

DescriptionCVE.org

The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to, and including, 28.1.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query inside the unauthenticated 'post_cg_gallery_form_upload' AJAX action (specifically the 'cb' branch of the included users-upload-check.php, where $f_input_id is concatenated unquoted into 'SELECT Field_Content FROM ... WHERE id = $f_input_id'). The endpoint is gated only by a public frontend nonce ('cg1l_action' / 'cg_nonce') that is exposed in the page source of any public gallery page. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in the Contest Gallery WordPress plugin (versions through 28.1.6) allows unauthenticated remote attackers to extract sensitive database contents by abusing the 'form_input' parameter handled by the 'post_cg_gallery_form_upload' AJAX action. The endpoint is gated only by a public nonce that is exposed in the page source of any public gallery page, effectively offering no protection against external attackers. No public exploit identified at time of analysis, but the issue was disclosed by Wordfence and affects a publicly reachable PHP endpoint.

Technical ContextAI

Contest Gallery is a WordPress plugin for photo upload, voting, and media monetization that ships with a frontend AJAX handler ('post_cg_gallery_form_upload') routed through users-upload-check.php. In the 'cb' branch of that handler, the attacker-controlled identifier $f_input_id is concatenated directly and unquoted into the SQL string 'SELECT Field_Content FROM ... WHERE id = $f_input_id' without using $wpdb->prepare or sanitization. This is a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) defect, made reachable because the only access control is a frontend nonce ('cg1l_action' / 'cg_nonce') that WordPress emits to anonymous visitors on any public gallery page, so any reader of the HTML can obtain a valid token and reach the vulnerable code path.

RemediationAI

No vendor-released patched version is identified in the provided data (Wordfence advisory references trac tag 28.1.5 as vulnerable and the description lists 28.1.6 as the last affected); administrators should consult https://www.wordfence.com/threat-intel/vulnerabilities/id/71f2f8c4-00ee-4ab4-b0e0-9ddac46818b3?source=cve for the fixed release once published and upgrade to the first version above 28.1.6. Until a fix is available, compensating controls include disabling/deactivating the Contest Gallery plugin (eliminates all gallery and upload functionality), blocking the 'post_cg_gallery_form_upload' AJAX action at the WAF or web server level by denying POST requests to /wp-admin/admin-ajax.php where action=post_cg_gallery_form_upload (breaks legitimate frontend uploads/votes), or restricting access to gallery pages via authentication so the gating nonce is not publicly emitted (changes the site's public UX). Wordfence rule sets typically virtual-patch this class of issue and are a reasonable interim control for sites that must keep the plugin enabled.