The Contest Gallery plugin registers an AJAX action, cg_check_wp_admin_upload_v10, for both authenticated and unauthenticated users without performing capability checks or nonce verification. This omission allows an unauthenticated attacker to call the endpoint and insert arbitrary WordPress media attachments into galleries, and to alter gallery metadata, thereby gaining unauthorised control over content displayed to site visitors. The vulnerability does not provide file upload or movement capabilities, so it is limited to gallery manipulation rather than full system compromise.

All WordPress sites running Contest Gallery versions up to and including 28.0.2 are affected. The issue is present in the plugin regardless of the WordPress core version, and the vendor is contest-gallery, as listed in the CNA data.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% and absence from the CISA KEV catalog suggest a low likelihood of widespread exploitation. The attack vector is through unauthenticated HTTP requests to the vulnerable AJAX endpoint; attackers can craft requests to inject media or modify gallery metadata. Because no file upload capability is provided, the impact is confined to manipulation of existing gallery content rather than arbitrary code execution.