Contest Gallery EUVD-2026-14654

Contest Gallery plugin for WordPress versions ≤28.1.5 with non-default RegMailOptional=1 setting enabled. Attacker registers with crafted email starting with target user ID. Unauthenticated remote exploitation; no victim interaction required.

Despite the high CVSS score of 8.1, the real-world risk is somewhat mitigated by the AC:H (High Complexity) rating and the requirement that the non-default RegMailOptional=1 configuration option be enabled. The attack vector is network-based (AV:N) requiring no privileges (PR:N) or user interaction (UI:N), which increases exploitability once the preconditions are met. The impact scope includes high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), as attackers gain full administrative control. No EPSS score or KEV listing is provided in the available data, suggesting this is a newly disclosed vulnerability without evidence of active exploitation in the wild yet. However, the detailed technical references to specific code lines in the WordPress plugin repository (lines 153 and 204) and the availability of a patch in version 28.1.6 indicate that security researchers have thoroughly analyzed the vulnerability. The attack complexity is elevated because it requires specific plugin configuration and knowledge of MySQL type coercion behavior, but the potential for complete site takeover makes this a genuine priority for affected installations. Organizations using Contest Gallery with the optional registration setting enabled should prioritize remediation immediately.

An unauthenticated attacker identifies a WordPress site running Contest Gallery plugin version 28.1.5 or earlier with the RegMailOptional=1 setting enabled. The attacker registers a new account using the crafted email '1poc@attacker.com' targeting the site administrator whose user ID is 1. During the email confirmation process, MySQL's type coercion converts the email string '1poc@attacker.com' to integer 1 in the WHERE ID = %s clause, causing the admin's user_activation_key to be overwritten with the attacker's known activation key. The attacker then calls the unauthenticated post_cg1l_login_user_by_key AJAX endpoint with their activation key, successfully authenticating as the site administrator and gaining complete control over the WordPress installation to install backdoors, steal data, or deface the site.