CVE-2024-30238 Overview
CVE-2024-30238 is a SQL injection vulnerability affecting the Contest Gallery plugin for WordPress, developed by Wasiliy Strecker. The flaw impacts all plugin versions up to and including 21.3.2. Attackers with low-privileged authenticated access can inject arbitrary SQL statements into database queries through the plugin. Successful exploitation compromises confidentiality, integrity, and availability of the underlying WordPress database. The issue is tracked under CWE-89, Improper Neutralization of Special Elements used in an SQL Command.
Critical Impact
Authenticated attackers can extract, modify, or destroy database contents on WordPress sites running Contest Gallery <= 21.3.2, leading to full data compromise.
Affected Products
- Contest Gallery plugin for WordPress (contest-gallery)
- All versions from initial release through 21.3.2
- WordPress installations with the plugin activated
Discovery Timeline
- 2024-03-27 - CVE-2024-30238 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-30238
Vulnerability Analysis
The Contest Gallery plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries. The plugin passes attacker-controlled parameters directly to database query functions without adequate escaping or parameterization. Authenticated users can craft malicious input that alters query logic and executes arbitrary SQL commands against the WordPress database.
Exploitation enables data exfiltration, including credentials stored in the wp_users table, session tokens, and plugin configuration secrets. Attackers can also write to the database to escalate privileges by promoting accounts to administrator or by injecting malicious content into posts and options. The vulnerability requires network access and low privileges but no user interaction.
Root Cause
The root cause is missing input neutralization on parameters supplied to SQL statements within the plugin's request handlers. The plugin does not consistently use WordPress prepared statements through $wpdb->prepare() or equivalent parameter binding. As a result, special characters such as single quotes and comment sequences pass through into query strings.
Attack Vector
The attack vector is network-based over HTTP/HTTPS against the WordPress site. An attacker authenticates as any low-privileged user, such as a subscriber or contributor account. The attacker then submits crafted parameter values to a vulnerable plugin endpoint. The injected SQL executes with the privileges of the WordPress database user, typically granting full read and write access to all site tables.
Refer to the Patchstack SQL Injection Vulnerability advisory for additional technical context.
Detection Methods for CVE-2024-30238
Indicators of Compromise
- Unusual SQL syntax such as UNION SELECT, SLEEP(, INFORMATION_SCHEMA, or 0x sequences in HTTP request parameters targeting Contest Gallery endpoints
- Unexpected new administrator accounts or modified wp_users and wp_usermeta records
- Spikes in database query duration or errors logged by MySQL or MariaDB when the plugin is active
- HTTP requests to Contest Gallery URLs originating from low-privileged authenticated sessions with encoded payloads
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule set that inspects requests to /wp-content/plugins/contest-gallery/ paths for SQL metacharacters
- Enable WordPress plugin activity logging and alert on write operations from non-administrator roles
- Correlate authentication events with subsequent database anomalies to identify low-privilege accounts abused for injection
Monitoring Recommendations
- Forward WordPress access logs and MySQL general or slow query logs to a centralized analytics platform for retention and search
- Alert on repeated 500-series responses from Contest Gallery endpoints, which can indicate blind SQL injection probing
- Track plugin version inventory across WordPress fleets to identify hosts running Contest Gallery <= 21.3.2
How to Mitigate CVE-2024-30238
Immediate Actions Required
- Update the Contest Gallery plugin to a version later than 21.3.2 on all WordPress installations
- Audit WordPress user accounts and revoke unexpected administrator privileges created after March 2024
- Rotate WordPress database credentials, admin passwords, and API keys if compromise is suspected
- Restrict registration and low-privileged account creation on public-facing WordPress sites until patched
Patch Information
Upgrade the Contest Gallery plugin beyond version 21.3.2. Consult the Patchstack Contest Gallery Vulnerability entry for the fixed release. Apply the update through the WordPress plugin manager or via WP-CLI in staging before production rollout.
Workarounds
- Deactivate and remove the Contest Gallery plugin until an upgrade is applied
- Place a WAF rule in front of WordPress that blocks SQL injection patterns in requests to plugin endpoints
- Enforce the principle of least privilege for the WordPress database user, removing DROP, ALTER, and FILE privileges where feasible
# Update Contest Gallery to the latest patched release using WP-CLI
wp plugin update contest-gallery --version=latest
# Verify the installed version
wp plugin get contest-gallery --field=version
# Temporary workaround: deactivate the plugin until patched
wp plugin deactivate contest-gallery
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
