5.3
Moyenne
CVE-2026-107120 The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end…
Description
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Contest Gallery 33.0 | premières → < 33.0.1 | 33.0.1 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Contest Gallery
Les 21 CVE de Contest Gallery →
CVE-2026-107447
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its…
5.3
Moyenne
CVE-2026-16055
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress…
7.5
Élevée
CVE-2026-16056
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its…
4.3
Moyenne
CVE-2026-16057
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its…
6.5
Moyenne