CVE-2026-8912 is an SQL Injection vulnerability in the Contest Gallery plugin for WordPress, affecting versions up to 28.1.6. The issue arises from improper neutralization of special elements in the 'form_input' parameter used in the 'post_cg_gallery_form_upload' AJAX action. Specifically, the parameter $f_input_id is concatenated unquoted into an SQL query, allowing unauthenticated attackers to append additional SQL commands. The endpoint is protected only by a public frontend nonce exposed in the page source, which does not provide effective security. This vulnerability enables extraction of sensitive information from the database without authentication.

An attacker can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not allow modification or deletion of data (no integrity or availability impact indicated), but confidentiality is compromised. The attack requires no privileges or user interaction and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected AJAX endpoint or implementing web application firewall (WAF) rules to detect and block malicious SQL payloads targeting the 'form_input' parameter. Monitor for updates from the vendor and apply patches promptly once available.