CVE-2026-3180

HIGH

Contest Gallery Plugin <28.1.4 - SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2026-3180. PoCs published by cardosource, carlosalbertotuma.

AI-analyzed exploit summary This exploit demonstrates a blind SQL injection vulnerability in WordPress Contest Gallery <= 28.1.4 via the 'cgl_maili' parameter, leveraging improper sanitization of email input to inject SQL payloads without authentication.

Description

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordEmail’ and the ’cgl_mail’ parameter in all versions up to, and including, 28.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability's ’cgLostPasswordEmail’ parameter was patched in version 28.1.4, and the ’cgl_mail’ parameter was patched in version 28.1.5.

Exploits (3)

exploitdb WORKING POC
by cardosource · pythonwebappsmultiple
https://www.exploit-db.com/exploits/52609

This exploit demonstrates a blind SQL injection vulnerability in WordPress Contest Gallery <= 28.1.4 via the 'cgl_maili' parameter, leveraging improper sanitization of email input to inject SQL payloads without authentication.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: WordPress Contest Gallery <= 28.1.4
No auth needed
Prerequisites: WordPress with Contest Gallery plugin installed · Network access to the target
devstral-2 · analyzed Jun 06, 2026 Full analysis →
github WORKING POC
by carlosalbertotuma · phppoc
https://github.com/carlosalbertotuma/cve-2026-3180-poc

The repository contains functional exploit code for CVE-2026-3180, targeting a WordPress plugin vulnerability. The code includes multiple PHP files demonstrating the exploitation of insecure direct object references and improper access controls.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Contest Gallery WordPress Plugin
No auth needed
Prerequisites: WordPress installation with Contest Gallery plugin
devstral-2 · analyzed Jun 09, 2026 Full analysis →
github WORKING POC
by cardosource · pythonpoc
https://github.com/cardosource/cve-2026-3180

This repository contains a functional exploit for CVE-2026-3180, demonstrating a blind SQL injection vulnerability in WordPress Contest Gallery 28.1.4 via the 'cgl_maili' parameter. The PoC includes a Python script to trigger the vulnerability and a Docker environment for testing.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: WordPress Contest Gallery 28.1.4
No auth needed
Prerequisites: WordPress with Contest Gallery plugin installed · Network access to the target
devstral-2 · analyzed Jun 05, 2026 Full analysis →

Scores

CVSS v3 7.5
EPSS 0.0053
EPSS Percentile 67.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
contest-gallery/Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe < 28.1.4
Published Mar 02, 2026
Tracked Since Mar 03, 2026