Contest Gallery CVE-2026-42660

Exploitation requires a valid WordPress subscriber-level account (or higher), which is obtainable through self-registration on sites with open registration enabled - the most common WordPress configuration. The CVSS PR:L metric confirms low-privilege authentication is the threshold; unauthenticated exploitation is not possible based on available data. No special plugin configuration, non-default settings, or specific feature enablement is identified in the description as a prerequisite beyond having the Contest Gallery plugin active and a subscriber account. Exploitation is limited by: (1) the need for at least a subscriber account - sites with registration disabled and no existing low-trust users face reduced exposure; (2) the impact is read-only (I:N, A:N) - no modification or disruption of data is achievable through this vector alone.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-accessible, low-complexity vulnerability requiring only subscriber-level authentication (PR:L) with no user interaction. The confidentiality impact is rated High (C:H) while integrity and availability are unaffected (I:N/A:N), indicating a pure data leakage scenario with no write-access risk. The scope is unchanged (S:U), confining the impact to the vulnerable WordPress instance. Real-world risk is elevated on sites that allow open subscriber registration, since any visitor can self-register and then exploit the flaw. No EPSS score was provided in the available data, so probability-weighted exploitation likelihood cannot be quantified. The absence of KEV listing and no known public exploit code moderate the urgency, but the ease of exploitation (AC:L, PR:L, AV:N) means mass automated scanning is plausible. This is a genuine remediation priority for any public-facing WordPress site running Contest Gallery, particularly where contest participant data (emails, submissions, personal details) may be at risk.

An attacker registers a free subscriber account on a WordPress site running Contest Gallery <= 28.1.7, then sends a crafted authenticated HTTP request - likely to a plugin AJAX action or REST endpoint - that returns sensitive contest or participant data without enforcing capability checks. The attacker harvests this data (potentially including participant emails, submissions, or internal plugin configuration) silently, with no further interaction required and no integrity changes that would alert administrators.