medium5.3
CVE-2026-107120
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which reli…
Impact
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.
Affected products
| Product | Affected versions |
|---|---|
| Contest Gallery WordPress Plugin | before 33.0.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.