Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure
Priority MEDIUM 56CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address
Why it matters now
EPSS 0.12004 96th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Contest Gallery – Photo Contest Plugin for WordPress (Unknown): 13.1.0.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Contest Gallery – Photo Contest Plugin for WordPress | 13.1.0.6 to before 13.1.0.6 | 13.1.0.6 | Patch available | CNA |
- Contest Gallery – Photo Contest Plugin for WordPress VendorUnknown Affected 13.1.0.6 to before 13.1.0.6 Fixed in 13.1.0.6 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:contest_gallery:contest_gallery:*:*:*:*:*:wordpress:*:* | before 13.1.0.6 | Vulnerable | Contest Gallery |
- cpe:2.3:a:contest_gallery:contest_gallery:*:*:*:*:*:wordpress:*:* Versions before 13.1.0.6 Vulnerable ·Contest Gallery
Remediation
- Fix · CNA Contest Gallery – Photo Contest Plugin for WordPress (Unknown) Fixed in 13.1.0.6
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24915
- 2026-10-03 Alias added: GHSA-986q-37xh-j7h2
References
Sources
- CVE-2021-24915 · CVE Program
- CVE-2021-24915 · NVD
- FIRST EPSS
- GHSA-986q-37xh-j7h2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences