This vulnerability is a CSRF issue (CWE-352) in the Contest Gallery Photos and Files Contest Gallery plugin for WordPress, which includes contact form, upload form, social share, and voting functionalities. It affects all versions up to 21.2.8.4. The vulnerability could allow an attacker to trick authenticated users into submitting unauthorized requests that may lead to limited integrity and availability impacts. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction.

The impact is limited to low integrity and low availability loss, as indicated by the CVSS vector (C:N/I:L/A:L). There is no confidentiality impact. Exploitation requires user interaction, and no privileges are needed to initiate the attack. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider implementing CSRF protections such as verifying nonce tokens or disabling the plugin if not essential. Monitor official vendor channels for updates and apply patches promptly once released.