CVE-2026-8912Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to, and including, 28.1.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query inside the unauthenticated 'post_cg_gallery_form_upload' AJAX action (specifically the 'cb' branch of the included users-upload-check.php, where $f_input_id is concatenated unquoted into 'SELECT Field_Content FROM ... WHERE id = $f_input_id'). The endpoint is gated only by a public frontend nonce ('cg1l_action' / 'cg_nonce') that is exposed in the page source of any public gallery page. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-06-05); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets1 URL

By indicator

https://www.cybernote.click/2026/06/01/cve-2026-8912-contest-gallery%e3%83%97%e3%83%a9%e3%82%b0%e3%82%a4%e3%83%b3%ef%bc%88%e3%83%90%e3%83%bc%e3%82%b8%e3%83%a7%e3%83%b328-1-6%e3%81%be%e3%81%a7%ef%bc%89%e3%81%ae%e8%84%86%e5%bc%b1%e6%80%a7/

Full discourse2 posts

Joey Romaine 🇺🇸 |=★=|@Tank23x0118d
Disclosure
New advisory to triage: CVE-2026-8912. The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to, and… Inventory first. Panic never helps.
Post summary
The advisory announces a new SQL injection vulnerability (CVE-2026-8912) affecting the Contest Gallery WordPress plugin, detailing the vulnerable parameter but not providing PoC, exploit code, or mitigation information.
1000036
339 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker137d
Disclosure
CVE-2026-8912 Contest Galleryプラグイン（バージョン28.1.6まで）の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/01/cve-2026-8912-contest-gallery%e3%83%97%e3%83%a9%e3%82%b0%e3%82%a4%e3%83%b3%ef%bc%88%e3%83%90%e3%83%bc%e3%82%b8%e3%83%a7%e3%83%b328-1-6%e3%81%be%e3%81%a7%ef%bc%89%e3%81%ae%e8%84%86%e5%bc%b1%e6%80%a7/ #IT #Security #cybersecurity
Post summary
The article announces and explains CVE-2026-8912, providing technical details and summarizing available countermeasures.
0000030
209 followersView on X

Explore more

Back to dashboard