CVE-2021-24915
Published: April 11, 2026
Official Description
The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address
Risk Analysis
The Contest Gallery WordPress plugin has a critical SQL injection vulnerability that allows unauthenticated users to perform SQL injection attacks and retrieve sensitive user information. Its presence in CISA's KEV catalog confirms active exploitation, making immediate action necessary.
This vulnerability is actively exploited in the wild. The flaw allows unauthenticated, remote SQL injection, potentially leading to data exfiltration.
Update the Contest Gallery WordPress plugin to version 13.1.0.6 or higher. Implement strict access controls and input validation for all database queries.
Technical Analysis
CVE-2021-24915 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2021-24915 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2021-24915 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1