Skip to main content

Contest Gallery Upload Vote Photos Media Sell With Paypal Stripe CVE-2026-78088

| EUVDEUVD-2026-80098 HIGH
Unrestricted Upload of File with Dangerous Type (CWE-434)
2026-09-16 Wordfence GHSA-xjx7-xfj8-wrqm
WordPress RCE File Upload Contest Gallery Upload Vote Photos Media Sell With Paypal Stripe Contest Gallery Wordpress Plugin
8.8
CVSS 3.1 · NVD
Share

Severity by source

Vendor (Wordfence) PRIMARY
HIGH
qualitative
NVD
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Sep 16, 2026 - 04:00 vuln.today
CVE Published
Sep 16, 2026 - 03:28 cve.org
HIGH 8.8

DescriptionNVD

The Contest Gallery - Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite known files which may lead to remote code execution when certain preconditions are met.

AnalysisAI

Arbitrary file overwrite in the Contest Gallery WordPress plugin (Upload & Vote Photos, Media, Sell with PayPal & Stripe) affects all versions up to and including 32.0.1, where the 'baseUrlForFacebook' parameter is passed to a file-writing routine without adequate path validation. Exploitation requires at least a subscriber-level account on the target WordPress site, but then allows overwriting known files on the server, which can escalate to remote code execution when the overwritten path is a PHP file that the web server later executes. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Contest Gallery Upload Vote Photos Media Sell With Paypal Stripe

View all
CVE-2026-12165 HIGH
8.8 Jun 17

Privilege escalation in the Contest Gallery WordPress plugin (versions ≤ 30.0.2) allows authenticated Contributor/Author
CVE-2026-4021 HIGH
8.1 Mar 23

The Contest Gallery plugin for WordPress contains an authentication bypass vulnerability that allows unaattacked attacke
CVE-2026-8912 HIGH
7.5 May 19

SQL injection in the Contest Gallery WordPress plugin (versions through 28.1.6) allows unauthenticated remote attackers

CVE-2026-16586 MEDIUM
6.5 Aug 15

Second-order SQL injection in the Contest Gallery WordPress plugin (all versions through 30.0.7) allows authenticated at

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2017-12617 HIGH POC
8.1
CVE-2024-50623 CRITICAL POC
9.8
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2018-9206 CRITICAL POC
9.8
CVE-2024-5084 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

CVE-2026-78088 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy