CVE-2026-107120 — Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN

CVE-2026-107120

Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN PUBLISHED

Description (CNA)

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.

Affected (CNA)

Vendor / product	Versions
Unknown / Contest Gallery	affected 0 before 33.0.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/13853303-741e-4f87-8543-d5d825d20e8e/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.