CVE-2026-107120 Contest Gallery CVE debrief

Who should care

Defenders responsible for WordPress installations using the Contest Gallery plugin should assess exposure and prioritize remediation efforts to prevent potential attacks. This includes reviewing the current plugin version, implementing additional security measures, and verifying the impact of a successful attack. Security teams and vulnerability management teams should also review this vulnerability and plan accordingly.

Why it matters

CVE-2026-107120 allows unauthenticated email verification bypass via brute-forceable registration PIN in Contest Gallery plugin, enabling attackers to create and activate WordPress accounts.

• Unauthenticated attackers can create and activate a WordPress account bound to an email address they do not own.
• Gaining an authenticated session can lead to further exploitation of the system.
• Defenders need to verify and remediate this vulnerability to prevent potential attacks.
• The impact of a successful attack requires verification from official sources.

Technical summary

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN. This allows unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session. The vulnerability affects WordPress installations using the Contest Gallery plugin, requiring defenders to assess exposure and prioritize remediation efforts.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their WordPress installations.

Recommended defensive actions

• Verify the version of the Contest Gallery plugin and update to 33.0.1 or later if necessary.
• Implement additional security measures to prevent brute-force attacks on the registration PIN.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN. This allows unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session. Evidence from the CVE Program and NIST NVD detail pages supports this assessment. However, the exact scope of affected systems and potential impacts requires further review

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.