CVE-2024-30236: 
WordPress vulnerability analysis and mitigation

An SQL Injection vulnerability was identified in the WordPress Contest Gallery plugin, tracked as CVE-2024-30236. The vulnerability affects Contest Gallery versions up to 21.3.4 and was discovered by Emili Castells. The issue was reported on February 8, 2024, and publicly disclosed by Patchstack on March 26, 2024 (Patchstack Database).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and has received a CVSS v3.1 base score of 8.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. The vulnerability requires Contributor-level privileges or higher to exploit (Patchstack Database).

This SQL injection vulnerability could allow a malicious actor with contributor-level access to directly interact with the database, potentially leading to unauthorized access to sensitive information. The high CVSS score indicates significant potential for data compromise (Patchstack Database).

The vulnerability has been assessed with a low patch priority despite its high CVSS score, suggesting it is unlikely to be exploited in the wild. The exploit requires authenticated access with Contributor-level privileges (Patchstack Database).

The vulnerability has been fixed in Contest Gallery version 21.3.5. Users are advised to update to this version or later to remediate the issue. Additionally, Patchstack has issued a virtual patch to mitigate this vulnerability by blocking potential attacks until users can update to the fixed version (Patchstack Database).