Contest Gallery CVE-2026-25035

No special conditions — remote unauthenticated exploitation against default installations of Contest Gallery version 28.1.2.2 and earlier. An alternate authentication path or channel allows attackers to bypass authentication without user interaction.

Although no CVSS vector or EPSS score has been assigned, the real-world risk is substantiated through multiple corroborating signals. The vulnerability directly enables account takeover (as noted in the Patchstack reference title), which represents a critical technical impact in SSVC terms. The authentication bypass classification (CWE-288) is inherently high-severity because it undermines the foundational security control of user identity verification. The fact that Patchstack—a reputable WordPress security researcher—has documented and catalogued this vulnerability indicates active discovery and likelihood of proof-of-concept development or exploitation. The absence of CVSS/EPSS metrics does not diminish risk; rather, it reflects the CVE's recent assignment (2026 date) and possible lack of NIST/NVD processing. For WordPress administrators, this should be treated as a critical priority given that (1) the attack vector is likely network-based with low complexity (typical of authentication bypasses), (2) no user interaction is required, and (3) the technical impact is complete compromise of user accounts. This is not a low-real-risk issue; it is a genuine, exploitable privilege escalation/account takeover vulnerability requiring immediate patching.

An attacker discovers the alternate authentication channel in a vulnerable Contest Gallery installation—for example, a direct API endpoint that does not properly validate WordPress nonces or session tokens, or a legacy authentication function that was left in place for backward compatibility. The attacker crafts a request to this endpoint with minimal authentication requirements (such as only a username, or a predictable token) to bypass the primary WordPress authentication layer and assume the identity of a target user, such as a contest administrator or site editor. Once authenticated through this alternate channel, the attacker gains full access to contest creation, user management, and potentially site configuration, enabling data theft, malicious contest injection, or lateral movement within the WordPress installation.