The Contest Gallery WordPress plugin implements an email‑verification step that uses a short numeric PIN, but it has no restriction on the number of attempts. This flaw allows an attacker to guess the PIN by brute‑forcing the PIN field. When the PIN is successfully guessed, the attacker is granted an authenticated WordPress session bound to an email address that the attacker does not own, providing the attacker with the ability to perform any action available to a newly registered user, including potential privileged site activities.

All WordPress sites using the Contest Gallery plugin version earlier than 33.0.1 are affected. The plugin is identified by the vendor "Unknown: Contest Gallery" in the CNA records. No earlier or later versions are known to contain this vulnerability.

An attacker can repeatedly request the verification code, brute‑force the PIN, and complete the registration flow using only HTTP requests. The attack vector is therefore remote and requires no user interaction or local access. It is inferred that the attacker only needs to automate or script the number of attempts, as the plugin accepts continuous attempts. The CVSS score of 5.3 indicates a medium severity, while the EPSS score of < 1% suggests that widespread exploitation may be low; however, in environments where the registration endpoint is publicly reachable, the flaw remains exploitable. This vulnerability is not listed in CISA’s KEV catalog.