Contest Gallery CVE-2025-11254

Injection requires no authentication and occurs via public gallery submission fields in Contest Gallery versions up to and including 27.0.3. However, exploitation is strongly limited by downstream conditions that must all hold: (1) a privileged user must export gallery submissions to a CSV file; (2) that user must open the CSV in a spreadsheet application (e.g. Excel/LibreOffice) that is configured to automatically execute formulas, DDE, or external content; and (3) the user must dismiss the security warnings modern spreadsheet software displays before formula execution. Because impact lands on the operator's local workstation rather than the WordPress server, and depends on a non-default 'vulnerable configuration,' realistic risk is far lower than the unauthenticated network entry point suggests.

This is a genuinely low-priority issue despite the 'RCE' tag. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3 Medium) correctly captures that exploitation is network-reachable and unauthenticated at the injection point, but the only impact is a Low integrity hit (I:L) gated behind required user interaction (UI:R) - specifically an administrator exporting and then opening the CSV in a spreadsheet application configured to execute formulas. EPSS reinforces low real-world risk at 0.34% (26th percentile), consistent with no CISA KEV listing and no public exploit identified at time of analysis. The signals are internally consistent rather than conflicting: a formula-injection flaw (CWE-1236) with multiple downstream preconditions. One point of tension to flag: the input Tags include 'RCE' and the description says 'code execution,' but any code execution occurs on the client workstation of whoever opens the file under a vulnerable spreadsheet configuration - it is not server-side remote code execution against WordPress, so the 'RCE' framing overstates the practical threat. Treat this as a hygiene/defense-in-depth fix, not an emergency.

An unauthenticated attacker submits a gallery entry containing a field beginning with a spreadsheet formula trigger (e.g. '=', '+', '-', '@'). Later a site administrator exports gallery submissions to CSV and opens the file in a spreadsheet application; if that application is configured to execute formulas or dynamic content and the admin dismisses security prompts, attacker-controlled commands run on the admin's workstation. No public exploit code or active exploitation is identified at time of analysis.