Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2026-3180 | Kitploit
Tools/GitHubGitHub/cardosource/cve-2026-3180
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringWeb SecurityPenetration Testing
GitHubcardosource/cve-2026-3180

cve-2026-3180

View Repository
2 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-3180 - WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection

Description

A Blind SQL Injection vulnerability was discovered in the WordPress Contest Gallery plugin versions 28.1.4 and earlier. The issue occurs due to unsafe use of the cgl_maili parameter, where the sanitize_email() function preserves the single quote character (') in the local part of the email address.

As a result, user-controlled input reaches wpdb->get_row() without proper parameterization via prepare(), allowing unauthenticated attackers to perform boolean-based blind SQL injection.

Vulnerability Details

AttributeValue
CVE IDCVE-2026-3180
ProductWordPress Contest Gallery
Affected Versions≤ 28.1.4
TypeBlind SQL Injection (Boolean-based)
AuthenticationNot required
Vectoradmin-ajax.php via cgl_mail parameter

Exploitation Requirements

  • WordPress with Contest Gallery plugin installed and active (version ≤ 28.1.4)
  • Access to the /wp-admin/admin-ajax.php endpoint
  • A valid nonce (can be obtained from public plugin pages)
Download Tool