Live › vulnerability › CVE-2026-107447
Go to dashboardThe Contest Gallery WordPress plugin trusts a client-supplied request header and an unbound client-generated token to enforce its one-vote-per-entry rule. An unauthenticated visitor can send crafted requests to cast repeated votes for the same entry and inflate its total.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Contest Gallery WordPress plugin before that run public voting contests. The exposure is limited to vote integrity; the sources do not describe access to site data or code execution. Sites without the plugin or without public voting contests can skip it.
34.0.1No product ranges from the sources yet.
wp plugin get contest-gallery --field=version if WP-CLI is available.34.0.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.
This page as .md · .json · in your agent: get_signal("CVE-2026-107447")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.