CVE-2025-22693
Published: 03 February 2025
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows SQL Injection.This issue affects Contest Gallery: from n/a through <= 25.1.0.
Security Summary
CVE-2025-22693 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, classified under CWE-89. It affects the Contest Gallery WordPress plugin (contest-gallery) developed by Wasiliy Strecker / ContestGallery, impacting all versions from n/a through 25.1.0.
The vulnerability carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L). It can be exploited over the network with low attack complexity by authenticated users possessing high privileges, requiring no user interaction. Exploitation enables high-impact confidentiality violations, such as unauthorized data extraction from the database, alongside low availability disruption and changed scope, but no integrity impact.
The Patchstack advisory provides further details on this WordPress Contest Gallery plugin 25.1.0 SQL injection vulnerability, including mitigation guidance: https://patchstack.com/database/Wordpress/Plugin/contest-gallery/vulnerability/wordpress-contest-gallery-plugin-25-1-0-sql-injection-vulnerability?_s_id=cve.
Details
- CWE(s)