Description
Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions.
Published: 2026-06-15
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Unauthenticated SQL injection exists in WordPress Contest Gallery plugin versions up to 28.1.6, allowing an attacker to construct arbitrary SQL statements against the database. This can result in reading, modifying, or deleting sensitive data and potentially providing a foothold for further attacks on the website or underlying server. The flaw is categorized as CWE‑89 (SQL Injection).

Affected Systems

The vulnerability affects the WordPress Contest Gallery plugin developed by Wasiliy Strecker, specifically all releases version 28.1.6 and earlier.

Risk and Exploitability

The CVSS score of 9.3 indicates an extremely high severity, and an EPSS score of less than 1% suggests a low current exploitation probability. The issue is not listed in the CISA KEV catalog. The likely attack vector is any unauthenticated user who can send a crafted request to the plugin’s input endpoints; this inference is drawn from the description of unauthenticated SQL injection, implying remote web-based exploitation that could provide direct database access.

Generated by OpenCVE AI on June 18, 2026 at 03:27 UTC.

Remediation

Vendor Solution

Update the WordPress Contest Gallery Plugin to the latest available version (at least 28.1.7).

OpenCVE Recommended Actions

  • Update the WordPress Contest Gallery Plugin to version 28.1.7 or later.
  • If the plugin is not required for your site, disable or uninstall it to eliminate the attack surface.
  • Limit the database permissions of the user WordPress uses so that it cannot execute arbitrary SQL queries beyond its intended scope.

Generated by OpenCVE AI on June 18, 2026 at 03:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 23 Jun 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Wasiliy Strecker
Wasiliy Strecker contest Gallery
Wordpress
Wordpress wordpress
Vendors & Products Wasiliy Strecker
Wasiliy Strecker contest Gallery
Wordpress
Wordpress wordpress

Tue, 16 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 15 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Description Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions.
Title WordPress Contest Gallery plugin <= 28.1.6 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Wasiliy Strecker Contest Gallery
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-06-16T12:32:24.744Z

Reserved: 2026-04-15T09:20:36.793Z

Link: CVE-2026-40771

cve-icon Vulnrichment

Updated: 2026-06-16T12:32:20.317Z

cve-icon NVD

Status : Deferred

Published: 2026-06-15T21:16:49.750

Modified: 2026-06-15T21:24:32.790

Link: CVE-2026-40771

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-23T21:07:35Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')