The Contest Gallery WordPress plugin, version 28.1.4, contains a critical Boolean-Blind SQL Injection vulnerability in the admin-ajax.php endpoint. An unauthenticated attacker can exploit this flaw to manipulate SQL queries, invalidate user activation keys, and compromise database integrity.

Root Cause

The vulnerability resides in the function responsible for resending confirmation emails (post_cg1l_resend_unconfirmed_mail_frontend). The cgl_mail parameter is received via POST and handled as follows:

$ReceiverMail = sanitize_email($_POST['cgl_mail']);

$wpdb->get_row("SELECT ... WHERE Field_Content = '$ReceiverMail'");