Remote Code Execution Risk in Contest Gallery Plugin for WordPress
CVE-2026-118041
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 11 November 2026
Badges
What is CVE-2026-118041?
The Contest Gallery plugin for WordPress, specifically versions prior to 34.0.3, has a significant vulnerability due to the lack of sanitation for uploaded file names through its e-commerce sale file-replacement feature. This oversight permits authenticated users, who have Author-level permissions and above, to upload files with arbitrary names and extensions to a web-accessible directory. Additionally, the ability to overwrite the directory's protection file potentially allows for Remote Code Execution, posing a severe security threat to the affected WordPress sites.
Affected Version(s)
Contest Gallery 0 < 34.0.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.