Read the docs
TI-2026-78608 Aliases CVE-2026-107447GHSA-7q93-xmpc-48mr

Vote restriction bypass in Contest Gallery WordPress plugin

Priority LOW 30CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction. It trusts a client-supplied request header and an unbound client-generated token (CWE-290). An unauthenticated remote attacker can bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00264 18th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Contest Gallery (Unknown): 34.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownContest Gallerybefore 34.0.134.0.1Patch availableCNA
  • Contest Gallery VendorUnknown Affected before 34.0.1 Fixed in 34.0.1 Patch available CNA

Remediation

Update Contest Gallery to version 34.0.1 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Contest Gallery (Unknown) Fixed in 34.0.1

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-107447
  2. 2026-10-21 Alias added: GHSA-7q93-xmpc-48mr

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences