[ CVE-2026-107120 · Published 10 Oct 2026 ]
Vulnerability in Unknown Contest Gallery
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.