CVE-2024-10687 is a critical SQL Injection vulnerability (CWE-89) in the Contest Gallery – Upload & Vote Photos, Media, Sell via PayPal, Social Share Buttons WordPress plugin. The vulnerability exists in all versions up to and including 24.0.3, specifically in the handling of the $collectedIds parameter. Insufficient escaping and lack of prepared statements allow unauthenticated attackers to append additional SQL queries, enabling time-based SQL Injection attacks. This can be exploited to extract sensitive information from the database.

Successful exploitation allows unauthenticated attackers to execute arbitrary SQL commands on the backend database. This can lead to disclosure of sensitive data, modification or deletion of data, and potentially full system compromise. The CVSS score of 9.8 reflects the critical nature of this vulnerability with network attack vector, no privileges required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.