The vulnerability is an incorrect privilege assignment flaw that enables an attacker to elevate their privileges within the WordPress Contest Gallery Pro plugin. By exploiting this weakness, a user with lower-level access can gain administrative capabilities over the plugin’s data and functionality, potentially compromising site settings and content.

The affected product is the Contest Gallery Pro plugin for WordPress, version 29.0.1 and all earlier releases. The vulnerability is present from the earliest vendor release through 29.0.1, impacting any site that has not upgraded past that point.

The CVSS score is 9.8, indicating critical severity. The EPSS score is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector requires an authenticated user with any level of access to the WordPress backend, who can then trigger high‑privilege actions through the plugin. Successful exploitation results in complete control of the plugin, allowing the attacker to modify or delete content, change user roles, or otherwise undermine site integrity.