CVE-2025-12849mediumCWE-862

CVE-2025-12849: fallo de gravedad media en contest-gallery Contest Gallery – Upload &…

Contest Gallery <= 28.0.2 - Missing Authorization

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.3%
The Contest Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 28.0.2. This is due to the plugin registering the `cg_check_wp_admin_upload_v10` AJAX action for both authenticated and unauthenticated users without implementing capability checks or nonce verification. This makes it possible for unauthenticated attackers to inject arbitrary WordPress media attachments into galleries and manipulate gallery metadata via the `cg_check_wp_admin_upload_v10` action. It does not enable an attacker to move or upload files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
contest-gallery · Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
CVEs relacionadas — contest-gallery Contest Gallery – Upload &…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-3180HIGHContest Gallery <= 28.1.4 - Unauthenticated SQL InjectionEPSS 1.1%CVE-2026-78088HIGHContest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' ParameterEPSS 0.8%CVE-2024-11103CRITICALContest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account TakeoverEPSS 0.8%CVE-2024-10687CRITICALPhotos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL InjectionEPSS 0.6%CVE-2026-16586MEDIUMContest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'EPSS 0.6%CVE-2026-4021HIGHContest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type ConfusionEPSS 0.5%