CVE-2026-8912

The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to, and including, 28.1.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query inside the unauthenticated 'post_cg_gallery_form_upload' AJAX action (specifically the 'cb' branch of the included users-upload-check.php, where $f_input_id is concatenated unquoted into 'SELECT Field_Content FROM ... WHERE id = $f_input_id'). The endpoint is gated only by a public frontend nonce ('cg1l_action' / 'cg_nonce') that is exposed in the page source of any public gallery page. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

• CWE-89

• https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/ajax/ajax-functions-frontend.php#L837
• https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/functions/frontend/cg-general-frontend.php#L12
• https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/v10/v10-frontend/user_upload/users-upload-check.php#L1036
• https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/v10/v10-frontend/user_upload/users-upload-check.php#L1193
• https://www.wordfence.com/threat-intel/vulnerabilities/id/71f2f8c4-00ee-4ab4-b0e0-9ddac46818b3?source=cve

Published

May 19, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89114SAP NetWeaver AS Java EDM Application does not perform an au…7.5
• CVE-2026-89115SAP Start Service and SAP Management Console store sensitive…4.4
• CVE-2026-89116The affected code used child_process.execSync with a shell s…5.9
• CVE-2026-89117SAP NetWeaver Enterprise Portal allows an unauthenticated at…6.1
• CVE-2026-89118SAP NetWeaver Enterprise Portal allows an unauthenticated at…5.3
• CVE-2026-89119SAP Web Dispatcher and SAP NetWeaver Application Server ABAP…9.6
• CVE-2026-89120A regression caused by an API change in SAP ABAP Platform re…7.1
• CVE-2026-89121SAP S/4HANA does not perform sufficient instance-level autho…4.7
• CVE-2026-89122SAP NetWeaver Enterprise Portal does not sufficiently valida…6.1
• CVE-2026-89124Display Product Catalog Based on Customs Declaration applica…4.3
• CVE-2026-89125Due to Insecure Storage of Sensitive Information in SAP Web …6
• CVE-2026-89126SAP Web Dispatcher does not sufficiently validate certain ne…10