CVE-2026-8912

The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to, and including, 28.1.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query inside the unauthenticated 'post_cg_gallery_form_upload' AJAX action (specifically the 'cb' branch of the included users-upload-check.php, where $f_input_id is concatenated unquoted into 'SELECT Field_Content FROM ... WHERE id = $f_input_id'). The endpoint is gated only by a public frontend nonce ('cg1l_action' / 'cg_nonce') that is exposed in the page source of any public gallery page. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

• CWE-89

• https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/ajax/ajax-functions-frontend.php#L837
• https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/functions/frontend/cg-general-frontend.php#L12
• https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/v10/v10-frontend/user_upload/users-upload-check.php#L1036
• https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/v10/v10-frontend/user_upload/users-upload-check.php#L1193
• https://www.wordfence.com/threat-intel/vulnerabilities/id/71f2f8c4-00ee-4ab4-b0e0-9ddac46818b3?source=cve

Published

May 19, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89092The nscd service in the GNU C Library 2.3.4 onwards may cras…4.2
• CVE-2026-89093The Better Messages – Chat Rooms, Group Chat, Private Messag…5.3
• CVE-2026-89094Forgejo before 16.0.4 allows remote code execution via a cra…9.9
• CVE-2026-89099A race condition in the document value layer of MongoDB Serv…7.5
• CVE-2026-8910The WP Emoticon Rating plugin for WordPress is vulnerable to…6.1
• CVE-2026-8911The WP AutoBuzz plugin for WordPress is vulnerable to Cross-…6.1
• CVE-2026-8913A command Injection vulnerability exists in the WireGuard cl…8.5
• CVE-2026-89138The Filter Gallery plugin for WordPress is vulnerable to aut…4.3
• CVE-2026-89139Temporal Server compiles a Worker Controller Instance module…8.7
• CVE-2026-8914In Teltonika Networks RUTOS devices, running versions 7.22 t…8.4
• CVE-2026-89141The AI Engine – The Chatbot, AI Framework & MCP for WordPres…6.5
• CVE-2026-89145Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HT…4.2