CVE-2024-30236: Contest Gallery SQL Injection Flaw

CVE-2024-30236 Overview

CVE-2024-30236 is a SQL injection vulnerability in the Contest Gallery plugin for WordPress, developed by Wasiliy Strecker. The flaw affects all versions up to and including 21.3.4. Authenticated attackers with low privileges can inject arbitrary SQL commands into database queries because the plugin fails to properly neutralize special elements in user-supplied input [CWE-89]. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying WordPress database. The vulnerability carries network attack vector characteristics with scope change, indicating downstream impact beyond the vulnerable component.

Critical Impact

Authenticated attackers can extract sensitive data, modify database records, and pivot to full site compromise across WordPress installations running Contest Gallery <= 21.3.4.

Affected Products

• Contest Gallery WordPress plugin versions up to and including 21.3.4
• WordPress sites with contest-gallery plugin installed and activated
• Multi-site WordPress deployments using the affected plugin

Discovery Timeline

• 2024-03-28 - CVE-2024-30236 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-30236

Vulnerability Analysis

The Contest Gallery plugin constructs SQL queries using attacker-controllable parameters without proper sanitization or parameterized statements. An authenticated user with low privileges supplies crafted input that breaks out of the intended query context. The database engine then executes attacker-supplied SQL alongside the legitimate query.

The vulnerability falls under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Scope change indicates the injected SQL can reach data beyond the plugin's own tables, including core WordPress tables such as wp_users and wp_usermeta. This enables privilege escalation by modifying user roles or extracting password hashes.

The EPSS score is 0.498% (66th percentile), reflecting moderate exploitation likelihood relative to other vulnerabilities. No public proof-of-concept has been published at the time of disclosure.

Root Cause

The root cause is direct concatenation of unsanitized request parameters into SQL statements within the plugin's PHP code. WordPress provides the $wpdb->prepare() API for parameterized queries, but the vulnerable code paths bypass this safeguard. Input validation routines do not strip or escape SQL metacharacters such as single quotes, comments, and statement terminators.

Attack Vector

An attacker authenticates to the target WordPress instance with any account that has access to the plugin's endpoints. The attacker then sends an HTTP request containing SQL payloads in vulnerable parameters. The plugin passes the payload directly to the database, executing attacker-controlled queries. No user interaction beyond the attacker's own request is required.

The vulnerability mechanism is documented in the Patchstack SQL Injection Advisory. Specific payload examples are not publicly disclosed to limit weaponization.

Detection Methods for CVE-2024-30236

Indicators of Compromise

• Unexpected outbound database query patterns containing UNION SELECT, SLEEP(, or INFORMATION_SCHEMA references in WordPress access logs
• New or modified administrator accounts in wp_users without corresponding audit log entries
• HTTP requests to Contest Gallery plugin endpoints under /wp-content/plugins/contest-gallery/ containing encoded SQL metacharacters
• Anomalous spikes in database error log entries originating from the plugin's PHP files

Detection Strategies

• Inspect web server access logs for SQL injection signatures targeting Contest Gallery parameters, including ', --, /*, and 0x hex sequences
• Deploy a Web Application Firewall (WAF) ruleset that blocks SQL injection patterns on plugin URIs
• Enable WordPress database query logging and alert on queries originating from plugin code that include user-controlled string concatenation
• Compare installed plugin version against the patched release using wp plugin list --name=contest-gallery via WP-CLI

Monitoring Recommendations

• Monitor authentication events for low-privilege accounts performing administrative actions following plugin endpoint access
• Track changes to WordPress user roles and capabilities in near real-time
• Forward WordPress and web server logs to a centralized analytics platform for correlation across the environment
• Baseline normal plugin traffic volume and alert on deviations that may indicate automated exploitation attempts

How to Mitigate CVE-2024-30236

Immediate Actions Required

• Update the Contest Gallery plugin to a version higher than 21.3.4 immediately
• Audit all WordPress user accounts and revoke any unrecognized or unnecessary privileges
• Rotate WordPress administrator passwords and force password resets for all users
• Review database contents for unauthorized modifications, especially in wp_users, wp_usermeta, and wp_options

Patch Information

Refer to the [Patchstack Vulnerability Report](https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-21-3-4-sql injection-vulnerability?_s_id=cve) for the fixed version and remediation guidance. Upgrade through the WordPress plugin dashboard or via WP-CLI using wp plugin update contest-gallery. Verify the patch by confirming the installed version exceeds 21.3.4 after the update completes.

Workarounds

• Deactivate and remove the Contest Gallery plugin until patching is feasible
• Restrict access to plugin endpoints at the web server layer using IP allowlisting for administrative paths
• Deploy virtual patching through a WAF with rules targeting the vulnerable parameters
• Limit account creation and reduce the number of authenticated low-privilege users on exposed WordPress instances

# Configuration example: update Contest Gallery via WP-CLI and verify version
wp plugin update contest-gallery
wp plugin list --name=contest-gallery --fields=name,status,version

# Optional: temporarily deactivate the plugin if a patch cannot be applied
wp plugin deactivate contest-gallery