The Contest Gallery WordPress plugin allows an attacker to overwrite files through the baseUrlForFacebook parameter. The code fails to validate the file path, permitting an arbitrary file write when the user has at least subscriber‑level permissions. If the attacker overwrites a PHP file or a core WordPress component, remote code execution can occur under specific preconditions. The flaw corresponds to CWE‑434, which covers insecure file uploads that can lead to code execution or privilege escalation.

All releases of Contest Gallery up to and including version 32.0.1 are vulnerable. The plugin is used for uploading and voting photos, media distribution, and e‑commerce via PayPal and Stripe. Site administrators who have installed any supported version of the plugin without applying the 33.0.0 or later fix are exposed to this vulnerability.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1 % suggests that exploitation is currently unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog. Attackers must first obtain subscriber‑level or higher access, which typically requires authentication. Once the necessary permissions are in place, the malformed baseUrlForFacebook input can be used to overwrite critical files, leading to remote code execution if the overwritten file is executed by the web server. Because the flaw requires authenticated access, the likelihood of exploitation depends on the ability to compromise a user account or to leverage an existing authenticated session.