WordPress Contest Gallery Plugin Unauthenticated Blind SQL Injection — CVE-2026-3180

Metadata

Affected Target

Summary

The Contest Gallery WordPress plugin passes the cgl_maili parameter through WordPress’s sanitize_email() function, which preserves the single-quote character (') in the local part of an email address. Because the sanitized value is subsequently used to build a $wpdb->get_row() query without going through $wpdb->prepare(), an attacker can smuggle a single quote past sanitization and into the SQL query, enabling unauthenticated boolean-based blind SQL injection via the plugin’s AJAX endpoint (admin-ajax.php, cgl_mail action).

Vulnerability Details

Root Cause

sanitize_email() does not strip the single-quote character from the local part of an email-formatted parameter (cgl_maili), and the resulting value reaches $wpdb->get_row() without parameterization via $wpdb->prepare(), allowing SQL syntax to be injected.

Attack Vector

1. Attacker obtains a valid WordPress nonce from a public page served by the Contest Gallery plugin.
2. Attacker sends a crafted request to /wp-admin/admin-ajax.php with the cgl_mail action, setting the cgl_maili parameter to an email-like string containing a single quote and boolean SQL injection payload.
3. sanitize_email() passes the quote through unmodified, and the value reaches $wpdb->get_row() unparameterized.
4. The attacker uses boolean-based blind injection techniques (true/false response differences) to extract data from the WordPress database without authentication.

Impact

Unauthenticated blind SQL injection against the WordPress database backing any site running the vulnerable Contest Gallery plugin version, potentially exposing all database contents (user credentials, site configuration, etc.).

Environment / Lab Setup

Target:   WordPress with Contest Gallery plugin <= 28.1.4 installed and active
Attacker: Python 3 with an HTTP client library (requests)

Proof of Concept

PoC Script

See cve-2026-3180.py in this folder.

1

python3 cve-2026-3180.py --url https://target-site.example --nonce <nonce>

The script obtains/accepts a valid nonce, then sends crafted cgl_maili values containing boolean SQL injection payloads to /wp-admin/admin-ajax.php (cgl_mail action), inferring true/false conditions from response differences to demonstrate blind SQL injection.

Detection & Indicators of Compromise

Signs of compromise:

• admin-ajax.php access logs with cgl_mail action requests containing ', AND, OR, SLEEP(), or similar SQLi indicators
• Abnormal response-time patterns on the cgl_mail endpoint consistent with time-based blind SQLi probing
• Database query logs showing malformed WHERE clauses originating from the plugin’s mail-lookup query

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/cardosource/cve-2026-3180 on 2026-07-05.