CVE-2026-107447— Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity
Quick assessment
Affected
Unknown Contest Gallery
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 34.0.1 版本之前，Contest Gallery WordPress 插件无法可靠地验证用于实施“每条目限投一票”限制的访客身份。该插件信任客户端提供的请求头以及由客户端生成且未绑定的令牌，这使得未授权用户能够绕过该限制，对同一竞赛条目进行多次投票，从而人为抬高其总票数。
Possible ATT&CK Techniques 1 AI
T1552.004 · Private Keys
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107447
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity
Source: CVE Program / CVE List V5
Vulnerability Description
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Contest Gallery | 0 ~ 34.0.1 | - |
|
II. Public POCs for CVE-2026-107447
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107447
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-21 · 53 CVEs total
| CVE-2026-85683 | 8.8 HIGH | Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL |
| CVE-2026-14556 | 5.4 MEDIUM | HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via clie |
| CVE-2026-105256 | 5.3 MEDIUM | LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter |
| CVE-2026-104641 | 5.3 MEDIUM | Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Re |
| CVE-2026-103301 | 5.3 MEDIUM | Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Emp |
| CVE-2026-101138 | 5.3 MEDIUM | CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass |
| CVE-2026-104642 | 2.7 LOW | Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verificatio |
| CVE-2026-106932 | Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice | |
| CVE-2026-110514 | WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR | |
| CVE-2026-105257 | LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR | |
| CVE-2026-107127 | Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF | |
| CVE-2026-107128 | Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Auth | |
| CVE-2026-107788 | SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion | |
| CVE-2026-107790 | WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title | |
| CVE-2026-107789 | SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR | |
| CVE-2026-108073 | SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter | |
| CVE-2026-109147 | WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter | |
| CVE-2026-109926 | Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation | |
| CVE-2026-110523 | WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registrati | |
| CVE-2026-100145 | Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callbac |
Showing top 20 of 53 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Contest Gallery
-
CVE-2026-111837
WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scri -
CVE-2026-107120
Contest Gallery < 33.0.1 - Unauthenticated Email Verificatio -
CVE-2026-61986
WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scri -
CVE-2026-16055
Contest Gallery < 30.0.7 - Unauthenticated Login-Protection -
CVE-2026-16056
Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History
Same vendor: Unknown
-
CVE-2026-85683
Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Con -
CVE-2026-14556
HappyForms < 1.26.15 - Unauthenticated HTML Injection in Adm -
CVE-2026-105256
LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'paym -
CVE-2026-104642
Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Mani -
CVE-2026-104641
Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypas
V. Comments for CVE-2026-107447
No comments yet