CVE-2026-3180: Contest Gallery WordPress SQL Injection

CVE-2026-3180 Overview

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress contains a blind SQL Injection vulnerability in the cgLostPasswordEmail and cgl_mail parameters. This vulnerability exists in all versions up to and including 28.1.4 due to insufficient escaping on user-supplied parameters and lack of sufficient preparation on the existing SQL query. Unauthenticated attackers can exploit this flaw to append additional SQL queries into already existing queries, enabling extraction of sensitive information from the WordPress database.

Critical Impact

Unauthenticated attackers can extract sensitive database information including user credentials, personal data, and potentially WordPress configuration details through blind SQL injection techniques without any authentication requirements.

Affected Products

• Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress versions up to and including 28.1.4 (cgLostPasswordEmail parameter)
• Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress versions up to and including 28.1.4 (cgl_mail parameter patched in 28.1.5)

Discovery Timeline

• 2026-03-02 - CVE CVE-2026-3180 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-3180

Vulnerability Analysis

This blind SQL injection vulnerability resides in the password recovery functionality of the Contest Gallery WordPress plugin. The vulnerable code is located in the users-login-check-ajax-lost-password.php file, which handles lost password requests via AJAX. When processing password reset requests, the plugin fails to properly sanitize and escape user-supplied email parameters before incorporating them into SQL queries.

The vulnerability is classified as CWE-89 (SQL Injection), representing improper neutralization of special elements used in SQL commands. Since this is a blind SQL injection, attackers cannot directly see query results but can infer database contents through time-based or boolean-based techniques. The network-based attack vector requires no authentication, making this vulnerability particularly dangerous for WordPress sites using this plugin.

Root Cause

The root cause is inadequate input validation and the absence of parameterized queries (prepared statements) in the password recovery functionality. The cgLostPasswordEmail and cgl_mail parameters are directly concatenated into SQL queries without proper escaping or use of WordPress's $wpdb->prepare() function. This allows specially crafted input to break out of the intended query context and execute arbitrary SQL commands.

Attack Vector

The attack is executed over the network through the WordPress AJAX handler. An unauthenticated attacker can send malicious POST requests to the lost password functionality endpoint, injecting SQL payloads through the cgLostPasswordEmail or cgl_mail parameters. Since this is a blind injection, attackers typically use time-based techniques (e.g., SLEEP() or BENCHMARK()) or conditional statements to extract data one character at a time by observing response timing differences or behavioral changes.

The vulnerable code paths can be examined in the WordPress plugin repository for version 28.1.3. The fix implemented in versions 28.1.4 and 28.1.5 involves proper parameterization as shown in the updated user functions file.

Detection Methods for CVE-2026-3180

Indicators of Compromise

• Unusual HTTP POST requests to Contest Gallery AJAX endpoints containing SQL syntax characters (single quotes, UNION, SELECT, SLEEP, BENCHMARK)
• Abnormally long response times from the lost password functionality indicating time-based SQL injection attempts
• Web server logs showing repeated requests to users-login-check-ajax-lost-password.php with varying email parameter values
• Database query logs showing malformed or concatenated SQL statements originating from the Contest Gallery plugin

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in cgLostPasswordEmail and cgl_mail parameters
• Monitor WordPress AJAX endpoints for anomalous traffic patterns and requests containing SQL meta-characters
• Implement database activity monitoring to detect unauthorized data extraction attempts or unusual query patterns
• Review web server access logs for patterns consistent with automated SQL injection scanning tools

Monitoring Recommendations

• Enable detailed WordPress debug logging and monitor for database errors related to the Contest Gallery plugin
• Configure security plugins like Wordfence to alert on SQL injection attempt patterns targeting the affected parameters
• Set up real-time alerts for abnormal database query execution times that may indicate time-based blind SQL injection
• Monitor for bulk data exfiltration patterns that could indicate successful exploitation

How to Mitigate CVE-2026-3180

Immediate Actions Required

• Update Contest Gallery plugin to version 28.1.5 or later immediately to address both vulnerable parameters
• If immediate patching is not possible, temporarily disable the Contest Gallery plugin until updates can be applied
• Review database access logs for signs of prior exploitation and conduct a security audit of stored data
• Consider implementing additional database access controls to limit potential damage from SQL injection attacks

Patch Information

The vulnerability was partially addressed in version 28.1.4 for the cgLostPasswordEmail parameter and fully patched in version 28.1.5 for the cgl_mail parameter. The fix implements proper SQL query preparation using WordPress's $wpdb->prepare() function. Site administrators should update to version 28.1.5 or later through the WordPress admin dashboard or by downloading from the WordPress plugin repository. Additional vulnerability details are available in the Wordfence threat intelligence report.

Workarounds

• Implement WAF rules to filter SQL injection payloads targeting the cgLostPasswordEmail and cgl_mail parameters until patching is complete
• Temporarily disable user registration and password reset functionality in the Contest Gallery plugin settings
• Use WordPress security plugins with SQL injection protection capabilities to add an additional layer of defense
• Restrict access to WordPress AJAX handlers at the web server level using IP whitelisting if feasible

# Example .htaccess rule to block suspicious requests to Contest Gallery AJAX
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} users-login-check-ajax-lost-password\.php
RewriteCond %{QUERY_STRING} (union|select|sleep|benchmark) [NC,OR]
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP:Content-Type} application/x-www-form-urlencoded
RewriteRule .* - [F,L]
</IfModule>