CVE-2024-32778: Contest Gallery Path Traversal Flaw

CVE-2024-32778 Overview

CVE-2024-32778 is a path traversal vulnerability in the Contest Gallery WordPress plugin developed by Wasiliy Strecker. The flaw affects all plugin versions up to and including 21.3.4. An authenticated attacker with low privileges can supply crafted pathname input to delete arbitrary files outside the intended directory. Successful exploitation compromises file integrity and application availability on affected WordPress sites. The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated attackers can delete arbitrary files on the WordPress server, potentially disabling the site or forcing WordPress into a re-installation state that enables further compromise.

Affected Products

Contest Gallery WordPress plugin versions up to and including 21.3.4
WordPress sites running the contest-gallery plugin by Wasiliy Strecker / ContestGallery
Any WordPress installation exposing plugin functionality to authenticated low-privilege users

Discovery Timeline

2024-06-09 - CVE-2024-32778 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32778

Vulnerability Analysis

The Contest Gallery plugin fails to properly validate and sanitize file path parameters passed to file-handling routines. An authenticated user can submit pathname input containing directory traversal sequences such as ../ to escape the plugin's intended working directory. The plugin then operates on the attacker-controlled path, which enables arbitrary file deletion outside the plugin's designated storage location.

The deletion primitive can target critical WordPress files including wp-config.php. Removing wp-config.php forces the site into the installation workflow, which an unauthenticated attacker can then abuse to point WordPress at an attacker-controlled database and achieve full compromise. This chain elevates a file-deletion flaw into a site-takeover scenario.

Root Cause

The root cause is missing canonicalization and allow-list validation of user-supplied path components before they reach file-system deletion calls. The plugin trusts request input to identify target files and does not confine operations to the plugin's own directory. This behavior maps to CWE-22.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated session with low privileges. No user interaction is required. The attacker submits a request to a vulnerable Contest Gallery endpoint with a manipulated file path parameter containing traversal sequences. The plugin processes the request and deletes the referenced file with the privileges of the web server.

No public proof-of-concept exploit code is available. Technical details are described in the Patchstack WordPress Vulnerability Advisory.

Detection Methods for CVE-2024-32778

Indicators of Compromise

Unexpected deletion of WordPress core files, particularly wp-config.php, .htaccess, or theme and plugin files
WordPress site unexpectedly redirecting to /wp-admin/install.php or the initial setup wizard
HTTP POST requests to Contest Gallery plugin endpoints containing ../ or URL-encoded %2e%2e%2f sequences in path parameters
File-system audit events showing deletions initiated by the PHP-FPM or web server user outside the plugin directory

Detection Strategies

Inspect web server access logs for authenticated requests to contest-gallery plugin endpoints containing traversal patterns in query strings or POST bodies
Monitor WordPress file integrity for unauthorized removal of core files, especially wp-config.php and files under wp-content/
Alert on sudden appearance of the WordPress installer page on production sites
Correlate low-privilege user sessions with file-deletion events on the underlying host

Monitoring Recommendations

Enable file integrity monitoring on the WordPress document root and wp-content/plugins/contest-gallery/
Forward web server and WordPress audit logs to a central SIEM for pattern matching on traversal sequences
Track plugin inventory to identify hosts running contest-gallery at version 21.3.4 or earlier

How to Mitigate CVE-2024-32778

Immediate Actions Required

Update the Contest Gallery plugin to a version later than 21.3.4 where the path traversal is patched
Audit all WordPress user accounts and remove or downgrade unnecessary low-privilege accounts that could reach the vulnerable code path
Verify integrity of wp-config.php, .htaccess, and other critical WordPress files
Restore any files identified as deleted or tampered with from a known-good backup

Patch Information

The vendor addressed the arbitrary file deletion issue in a release following 21.3.4. Refer to the Patchstack Contest Gallery Analysis for the fixed version and vendor advisory details. Apply the update through the WordPress plugin manager or wp-cli in a controlled maintenance window.

Workarounds

Deactivate and remove the Contest Gallery plugin until the patched version can be deployed
Restrict access to /wp-admin/ via IP allow-listing or a web application firewall while the plugin remains installed
Deploy a WAF rule that blocks requests to Contest Gallery endpoints containing ../, ..\, or their URL-encoded equivalents
Reduce web server file-system permissions so that the PHP process cannot delete files outside wp-content/uploads/ and the plugin's own directory

bash

# Example WAF rule pattern (ModSecurity) to block traversal in plugin requests
SecRule REQUEST_URI "@contains /wp-content/plugins/contest-gallery/" \
    "chain,phase:2,deny,status:403,id:1032778,msg:'CVE-2024-32778 path traversal attempt'"
    SecRule ARGS|REQUEST_BODY "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" "t:none,t:urlDecodeUni"