CVE-2026-16586 describes a second-order SQL injection vulnerability in the Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe WordPress plugin. The flaw exists in all versions up to and including 30.0.7, specifically via the 'cg_multiple_files_for_post' parameter leading to the 'cgRealId' SQL query. Due to improper neutralization of special elements in SQL commands (CWE-89), authenticated attackers with author-level privileges can inject additional SQL commands into existing queries. This can be leveraged to extract sensitive information from the database. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required.

An attacker with author-level or higher privileges can exploit this vulnerability to perform SQL injection attacks that may disclose sensitive information from the database. The vulnerability does not impact integrity or availability but compromises confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level access where possible and monitor for suspicious activity related to SQL injection attempts involving the 'cg_multiple_files_for_post' parameter.