CVE-2026-107447: medium-severity vulnerability in Contest Gallery
Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity
Published
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
exploitation probability
0.3%top 82% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Contest Gallerypublic PoCs found — 1
cve_referencewpscan.com/vulnerability/9b848bb1-8be6-4ba6-9fd0-c45997502bce/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Contest Gallery
In the same product, most dangerous first.
CVE-2022-4156HIGHContest Gallery < 19.1.5.1 - Unauthenticated SQL InjectionEPSS 1.0%CVE-2022-4160MEDIUMContest Gallery < 19.1.5 - Author+ SQL InjectionEPSS 1.0%CVE-2022-4157MEDIUMContest Gallery < 19.1.5 - Admin+ SQL InjectionEPSS 1.0%CVE-2022-4158HIGHContest Gallery < 19.1.5 - Unauthenticated SQL InjectionEPSS 1.0%CVE-2022-4151MEDIUMContest Gallery < 19.1.5 - Admin+ SQL InjectionEPSS 0.9%CVE-2022-4159MEDIUMContest Gallery < 19.1.5.1 - Author+ SQL InjectionEPSS 0.9%