CVE-2021-24915: Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-29 · updated 2026-06-17
Weakness: CWE-89

Description

The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address

Affected products

Contest Gallery – Photo Contest Plugin for WordPress: before 13.1.0.6 — fixed in 13.1.0.6

How to fix

Upgrade to a fixed version: Contest Gallery – Photo Contest Plugin for WordPress 13.1.0.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24915 or the next vulnerability affects your stack