CVE-2024-10687Disclosure(contest-gallery / contest_gallery)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons plugin for WordPress is vulnerable to time-based SQL Injection via the $collectedIds parameter in all versions up to, and including, 24.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

contest-gallery CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Patch / fix

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3175299%40contest-gallery%2Ftags%2F24.0.3&new=3180268%40contest-gallery%2Ftags%2F24.0.4

Vendor / third-party advisories

https://www.wordfence.com/threat-intel/vulnerabilities/id/fd3b4c44-d47a-45de-bcb2-0820e475b331?source=cve

Other references

https://plugins.trac.wordpress.org/browser/contest-gallery/tags/24.0.1/v10/v10-frontend/ecommerce/ecommerce-get-raw-data-from-galleries.php#L61

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

contest_gallery

Threat summary

Public PoC is present in monitored signal
1 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

contest-gallery

Products

contest_gallery

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://zerodaysignal.com/vulnerability/CVE-2024-10687

Full discourse1 post

0day Signal@0dayPublishing184d
Disclosure
🚨 CVE-2024-10687: Photos, Files, YouTube, Twitter,... Unauthenticated SQLi in a WordPress gallery plugin with 9.8 CVSS—time-based blind injection via $collectedIds means ful... https://zerodaysignal.com/vulnerability/CVE-2024-10687 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces a high‑severity unauthenticated SQL Injection in a WordPress gallery plugin, detailing the attack vector and CVSS score while linking to a vulnerability post.
0000060
204 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	contest-gallery	contest_gallery	-	wordpress	-

Explore more

Back to dashboard contest-gallery CVEs contest_gallery vulnerabilities