CVE-2026-107120: CWE-287 Improper Authentication in Contest Gallery
Description
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.
CVSS v3.1
Score 5.3medium
Affected software
Contest Gallery
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-107120 is an improper authentication vulnerability (CWE-287) in the Contest Gallery WordPress plugin versions prior to 33.0.1. The vulnerability arises because the plugin's front-end registration email verification step relies on a short numeric PIN and lacks rate limiting on the number of attempts. An attacker can brute-force this PIN to activate a WordPress account associated with an email address they do not control, resulting in unauthorized authenticated access.
Potential Impact
An attacker can gain unauthorized authenticated sessions by brute-forcing the email verification PIN during registration. This could allow account creation and activation for email addresses not owned by the attacker, potentially leading to account impersonation or unauthorized access to user-specific functionality within WordPress.
Mitigation Recommendations
Upgrade the Contest Gallery plugin to version 33.0.1 or later, where this vulnerability is fixed. Patch status is not explicitly stated but the affected versions are prior to 33.0.1, indicating that 33.0.1 contains the fix. No other mitigation is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-07T07:26:03.202Z
- State
- PUBLISHED
Threat ID: 6ac9d5582cdf04f6560b02b0
Added to database: 10/10/2026, 06:04:08 UTC
Last enriched: 10/10/2026, 06:18:55 UTC
Last updated: 10/10/2026, 21:26:33 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.