PT-2026-109517 · WordPress · Contest Gallery
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Contest Gallery versions prior to 33.0.1
Description
The front-end registration email-verification step of the plugin does not limit the number of attempts for the short numeric PIN used for verification. This allows unauthenticated attackers to brute-force the PIN to create and activate a WordPress account linked to an email address they do not own, resulting in an unauthorized authenticated session.
Recommendations
Update to version 33.0.1 or later.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Contest Gallery