CVE-2026-107447: Contest Gallery WordPress Auth Bypass

CVE-2026-107447 Overview

CVE-2026-107447 is an authentication bypass vulnerability in the Contest Gallery WordPress plugin before version 34.0.1. The plugin fails to reliably validate visitor identity when enforcing its one-vote-per-entry restriction. It trusts a client-supplied request header and an unbound client-generated token to identify unique voters. Unauthenticated attackers can manipulate these client-controlled values to cast multiple votes for the same contest entry, inflating vote totals and compromising contest integrity. The weakness is classified under CWE-290: Authentication Bypass by Spoofing.

Critical Impact
Unauthenticated attackers can bypass vote throttling and submit unlimited votes for any contest entry, undermining the integrity of any contest run through the plugin.

Affected Products

Contest Gallery WordPress plugin versions prior to 34.0.1
WordPress sites running the vulnerable plugin for public contests
Any contest workflow relying on the plugin's one-vote-per-visitor control

Discovery Timeline

2026-10-21 - CVE-2026-107447 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-107447

Vulnerability Analysis

The Contest Gallery plugin enforces its one-vote-per-entry restriction using identifiers provided by the voting client. The server reads a request header and a client-generated token to decide whether a visitor has already voted. Because both values originate on the client side, an attacker can modify them freely between requests. The plugin accepts each altered combination as a distinct visitor and records another vote.

The impact is limited to integrity of the contest voting data. The vulnerability does not expose confidential information or disrupt availability of the WordPress site. However, it defeats the primary trust assumption of the plugin: that each visitor casts a single vote.

Root Cause

The root cause is reliance on unverified client-side identity signals. The plugin treats a request header and an unbound token as authoritative visitor identifiers without server-side correlation to session state, authenticated identity, or server-issued nonces. This design falls under [CWE-290] because the server accepts spoofed identity attributes as genuine.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker scripts repeated POST requests to the vote endpoint, rotating the trusted header value and client token on each request. Each permutation registers as a new voter. The attacker can inflate a chosen entry's vote total to arbitrary values within rate limits imposed by the hosting infrastructure. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-107447

Indicators of Compromise

Rapid, repeated POST requests to the Contest Gallery vote endpoint from a single source IP address.
Vote submissions where the client-generated token or trusted request header value changes with each request from the same client.
Contest entries showing abnormal vote growth that deviates from historical traffic patterns.

Detection Strategies

Monitor web server access logs for high-volume POST activity against Contest Gallery AJAX or REST endpoints.
Correlate vote submissions with source IP, user agent, and session cookie to identify mismatches between claimed identity and network origin.
Alert on contest entries whose vote velocity exceeds a baseline derived from legitimate campaigns.

Monitoring Recommendations

Enable WordPress audit logging for plugin AJAX actions associated with Contest Gallery voting.
Deploy a Web Application Firewall (WAF) rule to flag or block repeated vote requests from the same IP within short time windows.
Review vote tallies and timestamps after contests close to detect retrospective manipulation.

How to Mitigate CVE-2026-107447

Immediate Actions Required

Update the Contest Gallery plugin to version 34.0.1 or later on every WordPress site that uses it.
Audit active and recently closed contests for suspicious vote patterns and recount affected entries if integrity is in question.
Restrict access to the voting endpoints behind a WAF or rate-limiting proxy until patching is complete.

Patch Information

The vendor addressed the issue in Contest Gallery version 34.0.1. The fix is documented in the WPScan Vulnerability Report. Site administrators should apply the update through the WordPress plugin management interface or by installing the updated package from the plugin repository.

Workarounds

Disable the Contest Gallery plugin until the update to 34.0.1 can be deployed.
Enforce strict rate limiting at the reverse proxy or WAF layer on the vote submission URL.
Require authenticated WordPress users for contest voting if the plugin configuration supports this option.

bash

# Example WAF rate-limit rule (nginx) for Contest Gallery vote endpoint
limit_req_zone $binary_remote_addr zone=cgvote:10m rate=5r/m;

location ~* /wp-admin/admin-ajax.php {
    limit_req zone=cgvote burst=2 nodelay;
    proxy_pass http://wordpress_backend;
}