CVE-2021-24915
📋 TL;DR
This vulnerability in the Contest Gallery WordPress plugin allows unauthenticated attackers to perform SQL injection attacks and retrieve all registered users' usernames and email addresses. It affects WordPress sites using vulnerable versions of the plugin due to missing capability checks and improper input sanitization.
💻 Affected Systems
- Contest Gallery WordPress Plugin
📦 What is this software?
Contest Gallery by Contest Gallery
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, and potential site takeover via SQL injection.
Likely Case
Unauthenticated attackers extract user data (usernames and emails) and potentially execute limited SQL queries.
If Mitigated
No impact if plugin is patched or workarounds are implemented.
🎯 Exploit Status
Public proof-of-concept exists, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 13.1.0.6
Vendor Advisory: https://wordpress.org/plugins/contest-gallery/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Contest Gallery plugin. 4. Click 'Update Now' if available, or manually update to version 13.1.0.6 or later.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the Contest Gallery plugin until patched.
wp plugin deactivate contest-gallery
Web Application Firewall Rule
allBlock requests containing 'cg-search-user-name-original' parameter.
🧯 If You Can't Patch
- Disable the Contest Gallery plugin immediately.
- Implement network-level filtering to block exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Contest Gallery version number.Check Version:
wp plugin get contest-gallery --field=versionVerify Fix Applied:
Confirm plugin version is 13.1.0.6 or higher.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing 'cg-search-user-name-original' parameter with SQL injection patterns
- Unusual database queries from web server process
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with cg-search-user-name-original parameter
- SQL error messages in HTTP responses
SIEM Query:
source="web_logs" AND uri="/wp-admin/admin-ajax.php" AND (param="cg-search-user-name-original" OR message="SQL syntax")