5.3
Moyenne
CVE-2026-107447 The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its…
Description
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Contest Gallery 34.0 | premières → < 34.0.1 | 34.0.1 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Contest Gallery
Les 21 CVE de Contest Gallery →
CVE-2026-107120
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end…
5.3
Moyenne
CVE-2026-16055
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress…
7.5
Élevée
CVE-2026-16056
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its…
4.3
Moyenne
CVE-2026-16057
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its…
6.5
Moyenne