The reported vulnerability allows an attacker to bypass authentication by exploiting an alternate path or channel within the Contest Gallery plugin. This authentication bypass can be used to gain unauthorized access to any user account, including administrative accounts, thereby giving the attacker full control over the WordPress site’s content, configuration, and potentially sensitive user data.

This issue affects the Contest Gallery WordPress plugin, developed by Wasiliy Strecker / Contest Gallery. All releases up to and including version 28.1.2.2 are vulnerable, with the problem present in every release prior to the unavailable baseline

The CVSS score of 9.8 indicates a critical severity, yet the EPSS score of less than 1% suggests that the likelihood of active exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalog, implying no known mass exploitation at this time. The attack vector is remote, requiring only access to the contested plugin’s alternate authentication channel, which an attacker can target through a website’s exposed endpoints. No special privileges or local conditions are required to exploit this flaw.