Contest Gallery WordPress plugin: Arbitrary file upload leading to remote code execution
Summary
The Contest Gallery WordPress plugin before version 34.0.3 does not sanitise file names uploaded through its e-commerce sale file-replacement feature. An authenticated user with Author-level access or higher can write files with arbitrary names and extensions to a web-accessible directory and overwrite the directory's protection file, which can lead to remote code execution on the web server. Exploitation requires a valid Author-level account.
Affected
- Contest Gallery WordPress plugin versions before 34.0.3 (CVE record: 0 to before 34.0.3; VulDB states up to 34.0.2)
Fixed in
- Update to version 34.0.3 or later
Workaround
- No vendor workaround documented.
- Until patched, review and remove unneeded accounts with Author or higher roles.
- VulDB suggests restricting upload permissions and blocking script execution in web-accessible upload directories at the web server level; confirm this works in your environment before relying on it.
Exploitation
- Not listed in CISA KEV; no EPSS score available.
- No public exploit code or Nuclei template known, and no evidence of exploitation in the wild as of 10 to 11 November 2026 (OffSeq snapshot).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory WordPress sites running the Contest Gallery plugin.
- Update to version 34.0.3 or later.
- Review and reduce accounts with Author or higher roles.
- After patching, check upload directories for unexpected files.
- If an installation was accessible to untrusted Author accounts before patching, review it for signs of compromise.
- Use CVSS 8.8 as the planning value until NVD confirms the score (VulDB scores 6.3).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record www.cve.org
- WPScan advisory wpscan.com
- VulDB vuldb.com
- OffSeq radar.offseq.com
- Strix www.strix.ai
- OpenCVE app.opencve.io
- WordPress.org plugin page wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:26.
Original description (NVD)
The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacement feature, allowing authenticated users with Author-level access and above to write files with an arbitrary name and extension to a web-accessible directory and, by overwriting the directory's protection file through the same flow, achieve Remote Code Execution.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.