Contest Gallery EUVD-2026-36980

No special conditions - remote unauthenticated exploitation against any WordPress site running Contest Gallery plugin version 28.1.6 or earlier with the vulnerable endpoint reachable over HTTP/HTTPS. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low attack complexity. Practical limits: the specific vulnerable parameter and endpoint have not been disclosed in the available data, the site must have the plugin installed and activated, and the plugin's database queries must be reachable without IP allowlisting or WAF interception; I:N in the CVSS vector also suggests the injection is read/blind-class rather than fully writable, which constrains tampering but not data theft.

Risk is meaningful but nuanced. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates remote, unauthenticated, low-complexity exploitation with no user interaction - classic mass-scanning bait for WordPress. However, the impact metrics (C:H/I:N/A:L with Scope:Changed) describe data disclosure plus limited availability impact rather than full database write or RCE, which tempers the headline 9.3 score. There is no CISA KEV listing and no EPSS score supplied in the input, and no public POC has been identified, so widespread automated exploitation is not yet confirmed. WordPress plugin SQLi historically gets weaponized quickly once a Patchstack advisory is public, so treat this as a near-term priority for any site running the plugin even though exploitation telemetry is currently missing.

An attacker scans the public internet for WordPress sites exposing Contest Gallery endpoints, then sends a crafted HTTP request containing a malicious SQL payload in a vulnerable parameter. Because the injection executes against the WordPress database with the plugin's privileges, the attacker can exfiltrate wp_users password hashes, session tokens stored in wp_usermeta, and arbitrary post or option data, then crack hashes offline to escalate to administrative access on the site.