Contest Gallery EUVD-2026-96126

Exploitation requires that the plugin's front-end user registration with email-verification be enabled, and depends on the verification code being a short numeric PIN with no limit on verification attempts (the missing rate-limit is the core flaw per CWE-287). The attacker must know or supply the target email address at registration time. The main limiting factor is that the attack only yields whatever privilege the plugin assigns to self-registered front-end accounts - typically low-privilege - rather than administrative access, and the site must actually offer public self-registration through Contest Gallery for the attack surface to exist. No authentication or user interaction is required (PR:N/UI:N).

This is a genuine but moderate-severity authentication weakness, not a critical priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, and the limited impact (C:N/I:L/A:N, base 5.3 Medium) is consistent with the outcome described: an attacker gains an authenticated account bound to an email they do not own, but does not directly compromise confidentiality or availability. No EPSS score, SSVC decision, KEV listing, or POC indicator was provided in the input, so exploitation-probability and automatability signals cannot be weighed - absence of these is not evidence of low risk, only of missing telemetry. The signals that ARE present are internally consistent (brute-forcing a short numeric PIN with no attempt limiting is inherently low-complexity and network-reachable), so there is no conflict between the CVSS vector and the description. Real-world priority is driven mainly by how the resulting account is used downstream: if the plugin's registration grants only subscriber-level access the impact is low, but if front-end accounts map to higher privileges or trusted identity, the integrity impact could be more serious than the base score suggests - verify the privilege level granted to registered accounts in the specific deployment.

An unauthenticated attacker initiates front-end registration on a site running Contest Gallery, supplying a victim's email address, then repeatedly submits guesses against the short numeric email-verification PIN because the plugin enforces no attempt limit. Once a correct PIN is found, the account is activated and the attacker obtains an authenticated session tied to the victim's email without ever controlling that mailbox. No public exploit was identified in the provided data, but the technique requires only scripted HTTP requests.