CVE-2026-25035: WordPress Contest Gallery plugin <= 28.1.2.2 - Account Takeover vulnerability
Published Mar 25, 2026
·Updated
Authentication Bypass Using an Alternate Path or Channel vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Authentication Abuse.This issue affects Contest Gallery: from n/a through <= 28.1.2.2.
Affected Software
1 affected component
Wasiliy Strecker Contest Gallery<=28.1.2.2
Event History
Mar 25, 2026
CVE Published
via MITRE·04:14 PM
Data Sourced
via MITRE·04:14 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-25035?
CVE-2026-25035 has a critical severity rating of 9.8 on the CVSS scale.
2
How do I fix CVE-2026-25035?
To fix CVE-2026-25035, update the Contest Gallery plugin to version 28.1.2.3 or later.
3
What exploit does CVE-2026-25035 enable?
CVE-2026-25035 allows for authentication bypass, enabling account takeover through unauthorized access.
4
Which version of the Contest Gallery plugin is affected by CVE-2026-25035?
CVE-2026-25035 affects the Contest Gallery plugin versions from n/a through 28.1.2.2.
5
Who is the developer of the vulnerable Contest Gallery plugin related to CVE-2026-25035?
The developer of the vulnerable Contest Gallery plugin is Wasiliy Strecker.