CVE-2026-16586: 
WordPress vulnerability analysis and mitigation

CVE-2026-16586 is a Second-Order SQL Injection vulnerability in the Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress. It affects all versions up to and including 30.0.7, and was published on August 15, 2026. The flaw allows authenticated attackers with author-level access or above to extract sensitive information from the database. It carries a CVSS v3.1 base score of 6.5 (Medium) (Wordfence, ENISA EUVD).

The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection). It is a second-order (stored) SQL injection, meaning malicious input is first stored via the cg_multiple_files_for_post parameter and later retrieved and unsafely incorporated into an SQL query through the cgRealId field without sufficient escaping or prepared statement usage. The vulnerable code paths are located in ajax/ajax-functions-backend.php (lines 135, 286, 310) and v10/v10-admin/gallery/change-gallery/0_change-gallery.php (lines 475, 683) (Wordfence, WordPress Trac).

Successful exploitation allows authenticated attackers (author-level and above) to append arbitrary SQL queries to existing database queries, enabling extraction of sensitive information from the WordPress database — including user credentials, email addresses, private post content, and plugin configuration data. The impact is limited to confidentiality (no integrity or availability impact per the CVSS scoring), but database credential exposure could facilitate further lateral movement or privilege escalation within the WordPress environment (Wordfence, ENISA EUVD).

As of the publication date (August 15, 2026), the EPSS score is 0.0, indicating no significant exploitation probability has been observed yet. No public proof-of-concept exploit code, active in-the-wild exploitation, or threat actor attribution has been reported. The vulnerability requires at minimum author-level authentication, which limits the attack surface compared to unauthenticated flaws. The CVE status is listed as "Received" with no CISA KEV catalog entry (ENISA EUVD, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Contest Gallery plugin at versions ≤ 30.0.7 using tools like WPScan or by inspecting plugin metadata in publicly accessible readme.txt files.
2. Obtain author-level access: Register or compromise an account with at least author-level privileges on the target WordPress site.
3. Inject malicious payload (first order): Submit a crafted value via the cg_multiple_files_for_post parameter containing SQL injection syntax. This payload is stored in the database without proper sanitization.
4. Trigger second-order execution: Perform an action that causes the plugin to retrieve the stored value and incorporate it into a subsequent SQL query via the cgRealId field in ajax-functions-backend.php or 0_change-gallery.php.
5. Extract sensitive data: The injected SQL appends additional queries (e.g., UNION SELECT statements) to dump sensitive database tables such as wp_users, retrieving hashed passwords, emails, and other confidential data (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing unusual POST requests to admin-ajax.php with parameters referencing cg_multiple_files_for_post or cgRealId containing SQL syntax (e.g., UNION, SELECT, --, ').
• Database: Unexpected or anomalous queries in MySQL slow query logs or general query logs involving the Contest Gallery tables with appended UNION SELECT clauses.
• File System: No specific file artifacts expected for this SQL injection type, but monitor for new admin accounts or modified user records in the wp_users table following exploitation.
• Process/Application: PHP error logs showing database query errors or warnings originating from ajax-functions-backend.php or 0_change-gallery.php that may indicate failed injection attempts.

Site administrators should update the Contest Gallery plugin to a version beyond 30.0.7 as soon as a patched release is available — the fix was introduced in changeset 3631928 in the WordPress plugin repository (WordPress Changeset). Until a patched version is confirmed available, consider deactivating the plugin on sites where author-level or higher access is granted to untrusted users. Additionally, implement a Web Application Firewall (WAF) rule to detect and block SQL injection patterns in plugin-related requests as a temporary mitigation (Wordfence).