CVE-2026-8912: WordPress Contest Gallery Plugin SQLi
The National Vulnerability Database has disclosed CVE-2026-8912, a high-severity SQL Injection vulnerability impacting the Contest Gallery plugin for WordPress, versions up to and including 28.1.6. This flaw stems from insufficient input escaping and inadequate preparation of existing SQL queries within the post_cg_gallery_form_upload AJAX action. Specifically, the form_input parameter, when processed in the cb branch of users-upload-check.php, is directly concatenated into a SELECT statement without proper sanitization.
Attackers can exploit this vulnerability without authentication. The required public frontend nonce (cg1l_action / cg_nonce) is readily exposed in the page source of any public gallery. This allows unauthenticated attackers to inject malicious SQL queries, enabling them to extract sensitive information directly from the WordPress database. This is a critical unauthenticated data exfiltration vector.
With a CVSS score of 7.5 (HIGH), this SQLi presents a significant risk. Any WordPress site running the Contest Gallery plugin must prioritize patching. The attacker’s calculus here is simple: find a public gallery page, grab the nonce, and then craft a payload to dump sensitive data. It’s a low-effort, high-reward scenario for them.
What This Means For You
- If your organization uses the WordPress Contest Gallery plugin, check your version immediately. Patch to a version beyond 28.1.6. Assume compromise if you were running affected versions, and audit your WordPress database for suspicious activity or unauthorized data access. This is an unauthenticated SQL injection, meaning anyone can exploit it.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-8912: WordPress Contest Gallery Plugin SQLi via form_input
title: CVE-2026-8912: WordPress Contest Gallery Plugin SQLi via form_input
id: scw-2026-05-19-ai-1
status: experimental
level: high
description: |
Detects SQL Injection attempts against the WordPress Contest Gallery plugin (versions up to 28.1.6) via the 'form_input' parameter in the 'post_cg_gallery_form_upload' AJAX action. The presence of 'action=post_cg_gallery_form_upload', 'form_input=', and 'cb' in the URI query, along with a SQL SELECT statement pattern, indicates a likely exploit attempt targeting CVE-2026-8912.
author: SCW Feed Engine (AI-generated)
date: 2026-05-19
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-8912/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/wp-admin/admin-ajax.php'
cs-uri-query|contains:
- 'action=post_cg_gallery_form_upload'
cs-uri-query|contains:
- 'form_input='
cs-uri-query|contains:
- 'cb'
cs-uri-query|contains:
- 'SELECT Field_Content FROM'
condition: cs-uri AND cs-uri-query
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-8912 | SQLi | WordPress Plugin: Contest Gallery <= 28.1.6 |
| CVE-2026-8912 | SQLi | Vulnerable Parameter: 'form_input' |
| CVE-2026-8912 | SQLi | Vulnerable AJAX Action: 'post_cg_gallery_form_upload' |
| CVE-2026-8912 | SQLi | Vulnerable File/Branch: users-upload-check.php (cb branch) |
| CVE-2026-8912 | SQLi | CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 19, 2026 at 16:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-20240 — Denial of Service
CVE-2026-20240 — In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129,...
Splunk Enterprise, Cloud Vulnerability Exposes Session Cookies, Sensitive Data
CVE-2026-20239 — In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a...
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data...