The Contest Gallery WordPress plugin up to and including version 28.0.2 contains an authorization bypass vulnerability. This flaw arises because the plugin registers an AJAX action accessible to unauthenticated users without proper capability checks or nonce verification. Exploitation allows unauthenticated attackers to inject arbitrary WordPress media attachments into galleries and manipulate gallery metadata, though it does not permit file uploads or moves.