Contest Gallery EUVD-2026-15576

Risk assessment is significantly hampered by the absence of a CVSS score, CVSS vector, and EPSS data. However, SSRF vulnerabilities are inherently high-risk due to their potential for broad impact: they can facilitate lateral movement within networks, expose sensitive metadata (e.g., AWS credentials), bypass firewalls, and enable attacks on internal services. The fact that this affects a WordPress plugin means exposure is widespread—any WordPress installation running Contest Gallery ≤28.1.2.1 is potentially vulnerable. Without confirmation of active exploitation (KEV status unknown) or public POC availability, the immediate exploitation risk cannot be quantified; however, SSRF flaws are well-understood and exploits are trivial to craft once the vulnerable endpoint is identified. The affected version range ('n/a through 28.1.2.1') suggests a long period of exposure. Given the ease of exploitation and broad plugin distribution, this should be treated as a priority vulnerability despite the absence of numerical risk scores.

An attacker identifies a WordPress site running Contest Gallery ≤28.1.2.1 and discovers an endpoint that accepts user-supplied URLs (e.g., an image import or gallery configuration parameter). The attacker crafts a request containing an internal URL such as 'http://127.0.0.1:8080/admin' or 'http://169.254.169.254/latest/meta-data/' (AWS metadata), causing the vulnerable plugin to fetch the resource server-side and return the response or side-effects to the attacker. This allows reconnaissance of internal services, credential theft from cloud metadata endpoints, or attacks against internal applications without direct network access. No POC availability is documented in current intelligence sources.