CVE-2026-107120: Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
Contest Gallery versions before 33.0.1 are affected. The issue is in the plugin's front-end registration email-verification flow.
What does an attacker need to exploit this?
An attacker does not need to authenticate. They need to repeatedly submit guesses for the short numeric registration PIN associated with an email address they do not own.
What access can successful exploitation provide?
A successful attacker can create and activate a WordPress account tied to the target email address and obtain an authenticated session.
How can this be mitigated?
Update Contest Gallery to version 33.0.1 or later. The provided information does not specify an alternative mitigation if updating cannot be performed immediately.