Skip to content
fr Sign in
5.3 Medium

CVE-2026-107447 The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its…

Description

The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.

Affected products and versions

Product Affected versions Fixed in
Contest Gallery 34.0 earliest → < 34.0.1 34.0.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Contest Gallery

The 21 CVEs of Contest Gallery →
CVE-2026-107120 The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end… 5.3 Medium CVE-2026-16055 The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress… 7.5 High CVE-2026-16056 The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its… 4.3 Medium CVE-2026-16057 The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its… 6.5 Medium
Track this CVE