Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-107120: Contest Gallery plugin lets attackers create accounts via PIN guessing
CVE-2026-107120 · published 25 days ago
Summary
The Contest Gallery WordPress plugin lets anyone try unlimited guesses of a short numeric PIN used for email verification. By guessing the PIN, an attacker can register and activate a WordPress account with an email address they don't own, giving them a logged‑in session. Update the plugin to version 33.0.1 or later, or add controls that limit guess attempts and use stronger verification codes.
What to do
- Update unknown contest gallery to version 33.0.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | contest gallery | < 33.0.1 |
Original advisory text
Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
5.3
Medium
Type
CWE-287Improper Authentication
Timeline
Published10 Oct 2026
Updated4 Nov 2026
First seen10 Oct 2026
Track software like this
Free during beta