CVE-2026-8912: Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection
The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'forminput' parameter in versions up to, and including, 28.1.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query inside the unauthenticated 'postcggalleryformupload' AJAX action (specifically the 'cb' branch of the included users-upload-check.php, where $finputid is concatenated unquoted into 'SELECT FieldContent FROM ... WHERE id = $finputid'). The endpoint is gated only by a public frontend nonce ('cg1laction' / 'cgnonce') that is exposed in the page source of any public gallery page. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8912?
CVE-2026-8912 has a high severity due to its ability to allow unauthenticated SQL injection attacks.
How do I fix CVE-2026-8912?
To fix CVE-2026-8912, update the Contest Gallery plugin to version 28.1.7 or later.
Which versions are affected by CVE-2026-8912?
CVE-2026-8912 affects versions of Contest Gallery up to and including 28.1.6.
What kind of attacks can be performed using CVE-2026-8912?
CVE-2026-8912 can be exploited to perform SQL injection attacks that may lead to unauthorized data access or manipulation.
Is user authentication required to exploit CVE-2026-8912?
No, CVE-2026-8912 can be exploited without any user authentication.