CVE-2026-118041: Contest Gallery < 34.0.3 - Author+ Arbitrary File Upload via Ecommerce Sale File Replacement

Q: Who can exploit this issue?

An authenticated WordPress user with the Author role or any higher-privileged role can exploit the affected e-commerce sale file-replacement feature.

Q: What does an attacker need to do to achieve code execution?

The attacker must use the sale file-replacement upload flow to write a file with an arbitrary name and extension into a web-accessible directory. They can also overwrite that directory's protection file through the same flow, enabling remote code execution.

Q: Are installations running version 34.0.3 affected?

No. The issue affects Contest Gallery versions before 34.0.3.

Published Nov 11, 2026

Updated

The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacement feature, allowing authenticated users with Author-level access and above to write files with an arbitrary name and extension to a web-accessible directory and, by overwriting the directory's protection file through the same flow, achieve Remote Code Execution.

Affected Software

1 affected component

Contest Gallery Contest Gallery WordPress plugin<34.0.3

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress user with the Author role or any higher-privileged role can exploit the affected e-commerce sale file-replacement feature.

What does an attacker need to do to achieve code execution?

The attacker must use the sale file-replacement upload flow to write a file with an arbitrary name and extension into a web-accessible directory. They can also overwrite that directory's protection file through the same flow, enabling remote code execution.

Are installations running version 34.0.3 affected?

No. The issue affects Contest Gallery versions before 34.0.3.

CVE-2026-118041: Contest Gallery < 34.0.3 - Author+ Arbitrary File Upload via Ecommerce Sale File Replacement

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to achieve code execution?

Are installations running version 34.0.3 affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to achieve code execution?

Are installations running version 34.0.3 affected?