Access Control Flaw in Contest Gallery by Wasiliy Strecker
CVE-2026-24965

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Contest Gallery
Vendor
CVE Published:
3 February 2026

What is CVE-2026-24965?

A missing authorization vulnerability in the Contest Gallery plugin affects improperly configured access controls, allowing unauthorized users to potentially exploit these security weaknesses. This issue impacts all versions of Contest Gallery through 28.1.1, enabling malicious actors to gain inappropriate access to functionalities and user data due to insufficient checks in security levels.

Affected Version(s)

Contest Gallery 0 <= 28.1.1

References

https://patchstack.com/database/Wordpress/Plugin/contest-...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lilmingwa13 | Patchstack Bug Bounty Program
.