Exploitation Summary
EIP tracks 4 public exploits for CVE-2026-3180. PoCs published by cardosource, CerberusMrXi, carlosalbertotuma.
AI-analyzed exploit summary This exploit demonstrates a blind SQL injection vulnerability in WordPress Contest Gallery <= 28.1.4 via the 'cgl_maili' parameter, leveraging improper sanitization of email input to inject SQL payloads without authentication.
Description
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordEmail’ and the ’cgl_mail’ parameter in all versions up to, and including, 28.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability's ’cgLostPasswordEmail’ parameter was patched in version 28.1.4, and the ’cgl_mail’ parameter was patched in version 28.1.5.
Exploits (4)
This exploit demonstrates a blind SQL injection vulnerability in WordPress Contest Gallery <= 28.1.4 via the 'cgl_maili' parameter, leveraging improper sanitization of email input to inject SQL payloads without authentication.
This repository claims to be a PoC for CVE-2026-3180 (WordPress Contest Gallery 28.1.4 Blind SQL Injection) but exhibits multiple red flags: excessive feature bloat (WAF bypass, reverse shells, report generation), vague technical details, and marketing-style README with buzzwords. The code is incomplete (truncated payloads) and lacks depth in vulnerability explanation.
The repository contains functional exploit code for CVE-2026-3180, targeting a WordPress plugin vulnerability. The code includes multiple PHP files demonstrating the exploitation of insecure direct object references and improper access controls.
This repository contains a functional exploit for CVE-2026-3180, demonstrating a blind SQL injection vulnerability in WordPress Contest Gallery 28.1.4 via the 'cgl_maili' parameter. The PoC includes a Python script to trigger the vulnerability and a Docker environment for testing.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N