A blind SQL injection vulnerability in Contest Gallery plugin versions up to 28.1.4 allows unauthenticated attackers to extract database contents without any credentials or nonces.
Tracked as CVE-2026-3180, the flaw stems from the unsafe handling of the cgl_mail parameter. The plugin’s sanitize_email() function preserves single quotes in the local part of email addresses, letting user-controlled input reach wpdb->get_row() without proper parameterization.
Researcher cardosource published the exploit on June 2, 2026. The attack uses boolean-based blind SQL injection — sending payloads like ‘OR/**/1=1#@teste.com and ‘OR/**/1=2#@teste.com to the admin-ajax.php endpoint and observing response differences to extract data bit by bit.
Because the vulnerability requires no authentication and no valid nonce, it’s particularly dangerous. Attackers can dump user tables, extract hashed passwords, and potentially gain admin access.
Contest Gallery is a popular WordPress contest and gallery plugin. Site administrators should update to the latest version immediately.
