CVE-2026-107120
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.
Risk Assessment
An attacker can gain access to a user account without knowing the password, potentially leading to account takeover, data theft, or use of the account for further attacks.
Recommendation
Update the Contest Gallery plugin to version 33.0.1 or later, which includes the security fix.
Other vulnerabilities in Contest Gallery
See all- CVE-2026-40771Critical
There is an unauthenticated SQL Injection vulnerability in Contest Gallery versions up to 28.1.6.
- CVE-2026-61986High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Contest Gallery plugin versions up to 30.0.5. An attacker can inject malicious script without authentication.
- CVE-2026-16586Medium
The Contest Gallery plugin for WordPress up to version 30.0.7 is vulnerable to second-order SQL injection via the cg_multiple_files_for_post and cgRealId parameters. Insufficient escaping and lack of query preparation allow authenticated attackers with author-level access to append additional SQL queries, potentially extracting sensitive information.
- CVE-2026-16055High
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication. This enables unlimited, unthrottled password guessing against any account (including administrators) up to full account takeover.
- CVE-2026-16057Medium
The Contest Gallery WordPress plugin before version 30.0.7 fails to perform capability or nonce checks in one of its post-deletion handlers, relying only on a coarse role-membership test. This allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.
- CVE-2026-65447High
A Cross Site Scripting (XSS) vulnerability in the Contest Gallery plugin for WordPress versions up to 30.0.6. An unauthenticated attacker can inject a malicious script.
- CVE-2026-42660Medium
Contest Gallery versions up to 28.1.7 have a vulnerability that allows for the exposure of subscriber sensitive data.
- CVE-2026-42657Medium
Contest Gallery versions up to 28.1.7 contain an unauthenticated vulnerability that may be exploited by attackers.
- CVE-2026-42656Medium
There is a Cross Site Scripting (XSS) vulnerability affecting subscribers in Contest Gallery versions up to 28.1.6.
- CVE-2025-12849Medium
The Contest Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 28.0.2. This is due to the plugin registering the `cg_check_wp_admin_upload_v10` AJAX action for both authenticated and unauthenticated users without implementing capability checks or nonce verification. This makes it possible for unauthenticated attackers to inject arbitrary WordPress media attachments into galleries and manipulate gallery metadata via the `cg_check_wp_admin_upload_v10` action. It does not enable an attacker to move or upload files.
Original NVD description (English source)
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS