Second-Order SQL Injection Vulnerability in Contest Gallery Plugin for WordPress
CVE-2026-16586

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Contest Gallery – Upload & Vote Photos, Media, Sell With Paypal & Stripe
Vendor
CVE Published:
15 August 2026

What is CVE-2026-16586?

The Contest Gallery plugin for WordPress presents a vulnerability related to second-order SQL injection through insufficient parameter escaping on 'cg_multiple_files_for_post' with 'cgRealId' input. This flaw allows authenticated attackers, who have author-level access or higher, to inject malicious SQL code into existing queries. This can lead to unauthorized access and extraction of sensitive database information, compromising overall security and potentially exposing user data.

Affected Version(s)

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe 0 <= 30.0.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/contest-galler...
https://plugins.trac.wordpress.org/browser/contest-galler...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.