The vulnerability stems from Contest Gallery’s reliance on a client‑supplied request header and an unbound client‑generated token to enforce a one‑vote‑per‑entry rule. Because these inputs are not verified against any server‑side credential, an unauthenticated user can forge the necessary identity data and successfully submit multiple votes for the same entry. The immediate effect is inflation of an entry’s vote total, which can distort contest outcomes and erode confidence in the system’s integrity.

The affected product is the Contest Gallery WordPress plugin. All installations of versions earlier than 34.0.1 are vulnerable; the fixed release is 34.0.1 and later. No specific vendor versioning details are provided beyond the major release number.

The CVSS score of 5.3 indicates moderate risk. EPSS data is not available, so the current exploitation probability cannot be quantitatively assessed, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote: an attacker simply sends crafted HTTP requests containing a spoofed client‑IP header and a forged token. There are no prerequisites for vulnerabilities such as privileged access or code execution; however, the attacker must be able to reach the web application and submit the vote form.