Description
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordEmail’ and the ’cgl_mail’ parameter in all versions up to, and including, 28.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability's ’cgLostPasswordEmail’ parameter was patched in version 28.1.4, and the ’cgl_mail’ parameter was patched in version 28.1.5.
Published: 2026-03-02
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated blind SQL injection may expose sensitive data
Action: Immediate Patch
AI Analysis

Impact

The Contest Gallery WordPress plugin allows unauthenticated attackers to append SQL queries through the cgLostPasswordEmail and cgl_mail parameters, resulting in a blind SQL injection vulnerability (CWE‑89). This flaw enables attackers to extract or modify database information without authentication, potentially compromising contestant data, financial records, or other sensitive content stored by the site.

Affected Systems

All installations of the Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress that use versions up to and including 28.1.4 are vulnerable. Version 28.1.4 includes a patch for the cgLostPasswordEmail parameter, while the cgl_mail parameter was fixed in version 28.1.5, so any active instance running a lower version is affected.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.5, indicating high severity. EPSS shows a very low exploitation probability (< 1%), and it is not listed in the CISA KEV catalog. The attack vector is likely through normal web requests to the plugin’s password reset or login endpoints; an attacker need only supply crafted parameters in a URL or form, making it easy to exploit remotely without needing prior authentication.

Generated by OpenCVE AI on April 15, 2026 at 18:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Contest Gallery plugin to version 28.1.5 or later, which contains patches for both vulnerable parameters.
  • Confirm that the WordPress core and all other plugins are also updated, as deploying the latest version of the platform helps mitigate related weaknesses.
  • If an upgrade is not immediately possible, temporarily restrict access to the password reset and login AJAX endpoints (for example, by blocking the URLs in .htaccess or a firewall) to prevent unauthenticated use of the vulnerable parameters.

Generated by OpenCVE AI on April 15, 2026 at 18:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Mar 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Contest-gallery
Contest-gallery contest Gallery – Upload & Vote Photos, Media, Sell With Paypal & Stripe
Wordpress
Wordpress wordpress
Vendors & Products Contest-gallery
Contest-gallery contest Gallery – Upload & Vote Photos, Media, Sell With Paypal & Stripe
Wordpress
Wordpress wordpress

Mon, 02 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 02 Mar 2026 17:45:00 +0000

Type Values Removed Values Added
Description The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordEmail’ and the ’cgl_mail’ parameter in all versions up to, and including, 28.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability's ’cgLostPasswordEmail’ parameter was patched in version 28.1.4, and the ’cgl_mail’ parameter was patched in version 28.1.5.
Title Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell With Paypal & Stripe
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:09:18.256Z

Reserved: 2026-02-25T05:48:17.651Z

Link: CVE-2026-3180

cve-icon Vulnrichment

Updated: 2026-03-02T19:27:03.564Z

cve-icon NVD

Status : Deferred

Published: 2026-03-02T18:16:28.297

Modified: 2026-04-22T21:26:58.303

Link: CVE-2026-3180

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T18:15:10Z

Weaknesses