Authentication Bypass in Contest Gallery Plugin for WordPress

CVE-2026-4021

What is CVE-2026-4021?

The Contest Gallery plugin for WordPress contains a vulnerability that allows an unauthorized attacker to bypass authentication and take control of administrator accounts. This issue stems from the use of the user's email address in the SQL query for authentication, rather than utilizing the numeric user ID. An attacker can exploit this flaw by registering with a specially crafted email address to manipulate the admin's activation key during the email confirmation phase. By leveraging an unauthenticated key-based login, an attacker can authenticate as an admin, leading to complete site control. This vulnerability affects all versions of the plugin up to and including 28.1.5.

References