PT-2026-52832

CVE-2026-57662

Published

2026-06-26

Updated

2026-10-25

Description by

CVSS 3.1

8.5

High

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Contest Gallery versions prior to 30.0.1

Description The Contest Gallery plugin for WordPress contains a SQL Injection flaw caused by insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries. Authenticated attackers with contributor-level access or higher can append malicious SQL queries to existing ones to extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 30.0.0.

Exploitability

Fix

Impacts

Researchers

Trương Hữu Phúc

Truonghuuphuc

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers