A SQL Injection flaw exists in the Contributor field of the WordPress Contest Gallery plugin versions ≤ 30.0.0. This vulnerability allows an attacker to inject arbitrary SQL statements, potentially exposing sensitive data stored in the WordPress database or causing unauthorized changes to application configuration. The weakness is designated CWE‑89 and could enable attackers to read or modify database contents if they can supply crafted input.

The plugin developed by Wasiliy Strecker, named Contest Gallery, is affected. All releases up through version 30.0.0 are vulnerable; users running 30.0.0 or earlier should consider those at risk. Versions 30.0.1 and later are not affected as the issue has been fixed in the upgrade.

The CVSS base score of 8.5 categorizes this flaw as high severity. No EPSS data is available and the vulnerability is not listed in KEV. The attack vector is most likely Web via the Contributor form or related API endpoints, requiring only unauthenticated or low‑privileged access to execute SQL statements. Exploitation is straightforward with standard SQL injection techniques, and the lack of mitigations in the affected plugin means an attacker could readily obtain database contents without additional privileges.