CVE-2026-78088 Overview
CVE-2026-78088 affects the Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress. The vulnerability allows arbitrary file overwrite through insufficient file path validation in the baseUrlForFacebook parameter. Attackers with subscriber-level access or higher can overwrite known files on the server, which may lead to remote code execution when specific preconditions are met. The flaw is categorized under [CWE-434] (Unrestricted Upload of File with Dangerous Type) and impacts all plugin versions up to and including 32.0.1.
Critical Impact
Authenticated attackers with minimal privileges can overwrite arbitrary files on WordPress installations running vulnerable Contest Gallery plugin versions, potentially achieving remote code execution.
Affected Products
- Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress
- All plugin versions up to and including 32.0.1
- WordPress sites permitting subscriber-level registrations
Discovery Timeline
- 2026-09-16 - CVE-2026-78088 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-78088
Vulnerability Analysis
The Contest Gallery plugin fails to properly validate the baseUrlForFacebook parameter passed to its Facebook like content handler. The plugin uses attacker-controlled input to construct file paths without adequate sanitization or restriction to a safe directory. This enables authenticated users to reference arbitrary file locations on the server.
Because the plugin writes content based on this parameter, an attacker can direct write operations against existing files outside the intended scope. Overwriting sensitive PHP files or configuration resources changes the execution behavior of WordPress or the plugin itself. When the overwritten file is later executed, attacker-controlled content runs in the context of the web server.
Exploitation requires only subscriber-level access, which is the lowest authenticated role on WordPress and is frequently open through self-registration. The relevant code change is documented in the WordPress Change Log Entry.
Root Cause
The root cause is missing path validation on the baseUrlForFacebook parameter inside 1_content-fb-like.php. The plugin trusts the client-supplied value and does not enforce a base directory, canonicalization, or extension allowlist before performing file operations.
Attack Vector
The attack is network-based and requires low-privilege authentication. An attacker registers a subscriber account, then submits a crafted request to the vulnerable endpoint with a manipulated baseUrlForFacebook value referencing a target file path. The plugin performs the write against that path, overwriting existing content.
The vulnerability manifests when the plugin processes the baseUrlForFacebook parameter without validation. See the Wordfence Vulnerability Report for detailed technical analysis.
Detection Methods for CVE-2026-78088
Indicators of Compromise
- Unexpected modification timestamps on PHP files within the wp-content/plugins/contest-gallery/ directory or elsewhere in the WordPress installation.
- Requests to 1_content-fb-like.php containing baseUrlForFacebook parameters that include path traversal sequences or absolute paths.
- New or modified files in web-accessible directories that were not created by legitimate administrator activity.
- Subscriber-level account creation followed shortly by POST requests to Contest Gallery plugin endpoints.
Detection Strategies
- Inspect HTTP request logs for POST requests targeting the Contest Gallery plugin containing baseUrlForFacebook parameters with suspicious values.
- Deploy file integrity monitoring across the WordPress installation to flag unexpected overwrites of PHP source files.
- Correlate low-privilege authentication events with subsequent file write activity on the web server.
Monitoring Recommendations
- Monitor WordPress user registration logs for automated or unusual subscriber account creation.
- Track outbound network connections from the web server that could indicate successful remote code execution.
- Alert on PHP process spawning system utilities such as sh, bash, or curl from the web server context.
How to Mitigate CVE-2026-78088
Immediate Actions Required
- Update the Contest Gallery plugin to version 33.0.0 or later on all WordPress sites where it is installed.
- Audit existing user accounts and remove unrecognized or dormant subscriber accounts.
- Review recent file modifications across the WordPress installation to identify potential overwrites.
Patch Information
The vendor addressed the flaw in Contest Gallery version 33.0.0. The fix is visible in the WordPress Change Log Entry, which shows updated validation in 1_content-fb-like.php. Administrators should apply the update through the WordPress plugin manager or by deploying the vendor-provided package.
Workarounds
- Disable the Contest Gallery plugin until the patched version can be deployed.
- Disable open user registration or restrict the default new-user role away from Subscriber if registration must remain enabled.
- Apply web application firewall rules that block requests containing path traversal patterns in the baseUrlForFacebook parameter.
- Enforce filesystem permissions that prevent the web server user from writing to plugin and core PHP files.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
