Contest Gallery CVE-2026-107447

Requires a site running Contest Gallery before 34.0.1 with an active contest that has voting enabled and at least one votable entry; exploitation targets the plugin's vote-submission flow, which enforces its one-vote-per-entry limit using a client-supplied request header plus an unbound client-generated token that the server trusts. No authentication, user interaction, or non-default configuration is needed beyond having the voting feature in use (PR:N/UI:N). The key limiting factor is impact scope: the flaw only permits vote-total inflation (I:L) and does not expose data (C:N) or disrupt availability (A:N), so realistic harm is confined to contest/poll integrity rather than site compromise.

This is a low-to-moderate severity integrity flaw, not a high-priority emergency. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N) correctly reflects a network-reachable, unauthenticated, low-complexity attack with no user interaction, but the impact is narrow: C:N/I:L/A:N - only a limited integrity effect (vote-count inflation), with no confidentiality loss, no availability impact, and no system compromise or code execution. Publicly available exploit code exists (reported by WPScan), which raises practical exploitability, but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation - treat the POC as proof the bypass is trivial rather than as confirmation of in-the-wild abuse. The signals are internally consistent (network vector matches a WordPress HTTP voting endpoint; PR:N matches 'unauthenticated users'), so there is no contradiction to resolve. Net assessment: patch as routine hygiene (update to 34.0.1+), prioritized only where contest vote integrity has business or reputational value; this is a legitimate but contained issue rather than a critical remote-compromise bug.

An unauthenticated attacker opens a Contest Gallery voting page, then repeatedly submits votes for a chosen entry while varying or forging the client-supplied identity header and the client-generated token that the plugin trusts to enforce its one-vote-per-entry limit. Because the server does not reliably bind these values to a real visitor, each forged request is counted as a distinct voter, letting the attacker arbitrarily inflate an entry's total. Public exploit code from WPScan demonstrates the bypass, lowering the skill required.