PT-2026-109517

CVE-2026-107120

Published

2026-10-10

Updated

2026-10-10

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contest Gallery versions prior to 33.0.1

Description The front-end registration email-verification step of the plugin does not limit the number of attempts for the short numeric PIN used for verification. This allows unauthenticated attackers to brute-force the PIN to create and activate a WordPress account linked to an email address they do not own, resulting in an unauthorized authenticated session.

Recommendations Update to version 33.0.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Akshat Parikh

Vendors

Affected products

Weakness enumeration

CWE-287: Improper Authentication

Related identifiers