Description

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-15T04:18:10.607Z",
  "pubdate": "2026-08-15T04:18:10.607Z",
  "executiveSummary": "The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is susceptible to a Second-Order SQL Injection vulnerability in all versions up to, and including, 30.0.7. This security flaw arises from insufficient escaping of user-supplied input and inadequate preparation of existing SQL queries within the application logic.\nThe vulnerability allows authenticated attackers possessing author-level access or higher to inject malicious SQL payloads that execute during subsequent database operations. Successful exploitation of this vulnerability enables adversaries to manipulate existing database queries, potentially leading to the extraction of sensitive information stored within the WordPress database.\nThe attack vector requires authenticated access with specific privilege levels, limiting unauthenticated exploitation but posing a significant risk from malicious or compromised internal users such as authors. The impact involves unauthorized data exposure and potential compromise of the underlying database integrity.",
  "technicalDetails": "The vulnerability is classified as a Second-Order SQL Injection flaw, manifesting through the 'cg_multiple_files_for_post' handling mechanism and the 'cgRealId' parameter. The affected component fails to properly sanitize and escape user-supplied data before storing it, and subsequently fails to utilize parameterized queries or proper preparation when executing database operations involving the stored data.\nThe affected versions include all releases of the Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin up to and including version 30.0.7. Exploitation requires the attacker to hold authenticated access with at least author-level privileges.\nThe attack flow proceeds in multiple stages. First, an authenticated attacker with author-level access or higher supplies a crafted malicious payload via the vulnerable 'cg_multiple_files_for_post' input vector, targeting the 'cgRealId' parameter. The application accepts this input and stores it within the database without adequate escaping or sanitization.\nSecond, at a later time, when the application retrieves and utilizes this stored data in a secondary database query without sufficient preparation, the injected payload is interpreted as executable SQL syntax rather than literal data. This results in the malicious SQL statements being appended to the existing query structure.\nThe post-exploitation impact includes the execution of arbitrary SQL commands within the context of the database user. This grants the attacker the ability to extract sensitive information, such as user credentials, configuration data, and other confidential records residing in the database tables."
}