An unauthenticated SQL injection vulnerability in the Contest Gallery WordPress plugin allows attackers to potentially access or manipulate sensitive database information.

The plugin fails to properly sanitize the 'form_input' parameter, leading to a classic SQL injection vulnerability (CWE-89) accessible to unauthenticated remote attackers.

The CVSS score of 7.5 reflects the high risk of unauthorized data access. Successful exploitation could allow an attacker to extract sensitive data from the WordPress database, including user credentials or private gallery content, leading to severe reputational and privacy-related consequences.

Immediate Action: Update the Contest Gallery plugin to version 28.1.7 or later.

Proactive Monitoring: Monitor database query logs for unusual patterns or syntax errors that suggest attempted SQL injection attacks.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets configured to block common SQL injection payloads.

Public Exploit Available: unknown

Given the ease with which SQL injection can be automated, immediate action is required. Administrators should update the Contest Gallery plugin to version 28.1.7 immediately; if an update is not feasible, the plugin should be deactivated until a secure version is deployed.