The Contest Gallery WordPress plugin allows attackers to assume the role of any site administrator without authentication. The vulnerability arises when the email confirmation mechanism uses the email string as a numeric ID in a database query, and a separate AJAX endpoint accepts an activation key for login. By registering a specially crafted email (e.g., one that begins with the target user’s numeric ID) while the optional registration mail flag is enabled, an attacker can trigger a confirmation flow that coerces the integer value and writes a new activation key for the victim admin. The attacker then submits this key to the AJAX login endpoint and authenticates as the admin, gaining full control of the WordPress site. The effect is a complete escalation of privilege that compromises both confidentiality and integrity of site data.

All installations of Contest Gallery plugin up to and including version 28.1.5 for WordPress sites are impacted. The vulnerability is tied to the specific files users-registry-check-after-email-or-pin-confirmation.php and ajax-functions-frontend.php within the plugin codebase.

The Security Scorecard assigns a CVSS score of 8.1, indicating high severity, while no EPSS score is available, making it unclear how frequently this bug is exploited in the wild. The flaw is not yet listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. The known attack path requires an attacker to be able to register a new user on the target site and to have the RegMailOptional setting set to 1; this may limit the prevalence of the vulnerability but still poses a serious risk when the environment is configured for optional registration emails. Once the required conditions are in place, exploitation is straightforward, involving no credentials, a crafted email address, and a single AJAX request.