Contest Gallery Pro EUVD-2026-33657

No special conditions - remote unauthenticated exploitation against default configurations of WordPress sites running Contest Gallery Pro plugin versions through 29.0.1 (CVSS vector confirms AV:N/AC:L/PR:N/UI:N). The only prerequisites are network reachability of the target WordPress site and the Contest Gallery Pro plugin being installed and activated; no user interaction, no existing account, and no non-default configuration are required per the CVSS vector. Limiting factors: the vulnerable plugin is a paid commercial extension rather than a free WordPress.org plugin, which constrains the installed base relative to mass-market plugins, and exploitation requires the attacker to identify sites running this specific plugin (fingerprintable via plugin asset paths).

The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates network-reachable, low-complexity, unauthenticated exploitation with high impact across confidentiality, integrity, and availability - consistent with full WordPress site takeover via administrator role escalation. EPSS data was not provided in the input, and the CVE is not listed in CISA KEV, so real-world exploitation pressure is currently unquantified. Patchstack-disclosed WordPress privilege escalation flaws of this severity are historically attractive to mass-exploitation bot operators, so despite no public exploit identified at time of analysis, the low complexity and unauthenticated reachability warrant treating this as a high priority. Key uncertainty: only one reference (Patchstack advisory) is provided and no vendor advisory URL is listed, so patched version availability cannot be independently confirmed from the supplied data.

An opportunistic attacker scanning the internet for WordPress sites running Contest Gallery Pro <= 29.0.1 sends a crafted HTTP request to a vulnerable plugin endpoint that mishandles privilege assignment, escalating their unauthenticated session - or a newly registered low-privilege account - to administrator. With admin access they install a malicious plugin or theme to achieve arbitrary PHP execution, pivot to the underlying host, and add the site to a botnet or SEO-spam farm. No public exploit identified at time of analysis, but the unauthenticated AV:N/AC:L profile makes mass-scan weaponization plausible once details are reverse-engineered from the patch.