The Contest Gallery WordPress plugin is vulnerable to CSV Injection (CWE-1236) through untrusted input in gallery submissions. This vulnerability enables unauthenticated attackers to embed malicious formula elements into exported CSV files. When such files are opened in spreadsheet applications that process these formulas, it can lead to code execution on the local system. The issue affects all plugin versions up to 27.0.3. The CVSS 3.1 base score is 4.3, indicating medium severity, with attack vector network, low attack complexity, no privileges required, and user interaction required.

The vulnerability allows injection of malicious formulas into CSV exports, which can lead to code execution when the file is opened by a user in a vulnerable spreadsheet application. This can compromise the local system of the user opening the CSV file. The vulnerability does not impact confidentiality or availability directly but poses an integrity risk via code execution. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution when opening CSV files exported from the Contest Gallery plugin, especially those received from untrusted sources. Consider sanitizing or validating CSV content before opening in spreadsheet software. Monitor vendor channels for updates or official fixes.