Contest Gallery CVE-2026-42657

Exploitation requires that the target WordPress site has the Contest Gallery plugin (by Wasiliy Strecker) installed and activated in a version at or below 28.1.7, and that at least one contest or gallery instance is publicly accessible to unauthenticated visitors - which is the plugin's default intended deployment for public voting scenarios. No authentication, no special privileges, and no user interaction are required per the CVSS vector (PR:N/UI:N). Exploitation is limited to the integrity impact class (I:L) within the plugin's own data scope; the unchanged scope (S:U) means the attacker cannot leverage this vulnerability to directly compromise the broader WordPress installation or underlying server. Sites that have Contest Gallery installed but restrict all plugin endpoints behind authentication (e.g., members-only contests) would significantly reduce exploitability.

The CVSS base score of 5.3 (Medium) is consistent with the vector metrics: network-reachable, no authentication, low complexity, but constrained to low integrity impact only with no confidentiality or availability consequences (C:N/I:L/A:N/S:U). No EPSS probability score was provided in the source data, limiting probabilistic exploitation forecasting. The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept exploit code has been identified, substantially reducing urgency relative to the theoretical attack surface. The unchanged scope (S:U) means exploitation is contained to the plugin's own data context and does not imply lateral movement or privilege escalation within the WordPress instance. The 'Information Disclosure' tag conflicts with the C:N CVSS metric - this discrepancy is unresolved from available data and should be confirmed against the full Patchstack advisory before concluding no data exposure is possible. Real-world priority is moderate for publicly exposed WordPress sites running this plugin with untrusted user populations, but does not warrant emergency response in the absence of active exploitation signals.

An unauthenticated remote attacker sends a crafted HTTP request to a Contest Gallery plugin endpoint on a publicly accessible WordPress site, supplying a manipulated quantity parameter - such as a vote count or entry index - that bypasses server-side validation due to CWE-1284. The plugin accepts and persists the malformed value, altering contest data integrity (e.g., inflated vote counts, manipulated entry ordering) without any authentication requirement. No exploit code is publicly known, but the low complexity and zero-authentication requirement make manual exploitation straightforward for any attacker familiar with the plugin's request structure.