CVE-2026-107447: Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Contest Galleryto a version that resolves this vulnerability.Fixed in 34.0.1
Event History
Frequently Asked Questions
Which installations should be prioritized for remediation?
Contest Gallery installations running a version earlier than 34.0.1 should be prioritized, especially where public visitors can vote in contests.
Does exploitation require an account or user interaction?
No. The issue is unauthenticated and requires no user interaction; an attacker can manipulate the client-supplied identity information used by the voting restriction.
What identity mechanisms are unsafe to rely on for enforcing the vote limit?
The affected plugin relies on a client-supplied request header and a client-generated token that is not bound to the visitor. Either can be spoofed or forged to evade the one-vote-per-entry restriction.