CVE-2026-16586: 
WordPress Análise e mitigação de vulnerabilidades

CVE-2026-16586 is a Second-Order SQL Injection vulnerability in the Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress. It affects all versions up to and including 30.0.7, allowing authenticated attackers with author-level access or above to extract sensitive information from the database. The vulnerability was published on August 15, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.5 (Medium/High) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vulnerability is a second-order SQL injection, meaning malicious input is first stored in the database via the cg_multiple_files_for_post parameter and later retrieved and used unsafely in a subsequent SQL query through the cgRealId field, due to insufficient escaping and lack of prepared statements. The vulnerable code paths are present in ajax/ajax-functions-backend.php (lines 135, 286, 310) and v10/v10-admin/gallery/change-gallery/0_change-gallery.php (lines 475, 683) in versions 30.0.6 and 30.0.7. Exploitation requires network access and at least author-level WordPress authentication (Wordfence, WordPress Trac).

Successful exploitation allows authenticated attackers to append additional SQL queries to existing database queries, enabling extraction of sensitive information from the WordPress database — including user credentials, email addresses, private post content, and plugin configuration data. The impact is primarily a high confidentiality loss with no direct integrity or availability impact per the CVSS scoring. Lateral movement within the WordPress environment is possible if extracted credentials are reused or if administrative account data is recovered (Wordfence, ENISA EUVD).

As of the disclosure date, there is no known public exploit code and no evidence of in-the-wild exploitation. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the requirement for authenticated access. The EPSS score is approximately 0.33%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Contest Gallery plugin at versions ≤ 30.0.7 using tools like WPScan or by inspecting plugin directories.
2. Obtain authenticated access: Register or compromise an account with at least author-level privileges on the target WordPress site.
3. Inject first-order payload: Submit a crafted value containing SQL injection syntax into the cg_multiple_files_for_post parameter during a file upload or post creation action. This payload is stored in the database without proper sanitization.
4. Trigger second-order execution: Perform an action (e.g., accessing gallery management functions) that causes the application to retrieve the stored cgRealId value and incorporate it into a new SQL query without adequate escaping or prepared statements.
5. Extract data: The injected SQL appends additional queries (e.g., UNION-based or time-based blind injection) to retrieve sensitive database contents such as WordPress user hashes, emails, or configuration data (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing repeated or unusual POST requests to admin-ajax.php with parameters referencing cg_multiple_files_for_post or cgRealId; database error logs indicating malformed SQL queries or unexpected UNION/SELECT statements.
• Database: Unexpected or anomalous queries in MySQL slow query logs or general query logs involving the Contest Gallery tables with appended SQL clauses.
• File System: No specific file artifacts expected for this SQL injection type, but monitor for new admin accounts or changed user credentials in the wp_users table following suspicious activity.
• Network: Unusual outbound connections from the web server following exploitation attempts, which may indicate data exfiltration.

Users should update the Contest Gallery plugin to a version above 30.0.7 as soon as a patched release is available. The fix was introduced via the changeset at the WordPress plugin repository. Until an update is applied, site administrators should restrict author-level account creation and monitor database activity for anomalous queries. Web application firewalls (WAFs) with SQL injection rules can provide partial mitigation (Wordfence, WordPress Changeset).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for August 10–16, 2026, and published the advisory through their threat intelligence platform. No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been identified (Wordfence Blog).