CVE-2026-78088

HighCVSS 8.8

Published: 16/09/2026(UTC)Updated: 16/09/2026(UTC)Translated: 16/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.60%

47th percentile - higher than 47% of all known CVEs

Summary

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress in all versions up to and including 32.0.1 is vulnerable to Unauthenticated Arbitrary File Overwrite due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This allows authenticated attackers with subscriber-level access and above to overwrite known files, which may lead to remote code execution when certain preconditions are met.

Risk Assessment

A low-privileged attacker can overwrite files on the server, potentially leading to remote code execution and full site compromise. This results in possible server takeover and data theft.

Recommendation

Update the Contest Gallery plugin to a version later than 32.0.1 or disable it if no update is available. Restrict user privileges to the minimum necessary.

Other vulnerabilities in Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

CVE-2026-12165High
The Contest Gallery plugin for WordPress is vulnerable to privilege escalation in versions up to and including 30.0.2 via the `RegistryUserRole` parameter. This allows users with author-level access and above to overwrite the `RegistryUserRole` option to `administrator`.

Original NVD description (English source)

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite known files which may lead to remote code execution when certain preconditions are met.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS