A high-severity authentication flaw in the Contest Gallery WordPress plugin allows attackers to bypass essential security controls including brute-force protection and multi-factor authentication.

The plugin utilizes a custom authentication flow for front-end logins that does not integrate with standard WordPress security hooks. This failure allows authenticated users to bypass critical brute-force protections and existing two-factor authentication implementations.

By bypassing brute-force and 2FA protections, this vulnerability significantly lowers the barrier for attackers to perform credential stuffing or password spraying against the application. With a CVSS score of 7.5, the potential for unauthorized access to user accounts and subsequent escalation of privileges warrants immediate attention.

Immediate Action: Update the Contest Gallery plugin to version 30.0.7 or later to ensure all login attempts are routed through the standard, secure WordPress authentication flow.

Proactive Monitoring: Monitor login logs for high volumes of failed attempts that do not trigger standard account lockout mechanisms.

Compensating Controls: If immediate patching is not possible, disable the front-end login feature provided by the plugin and force users to utilize the native WordPress login interface.

Public Exploit Available: Unknown.

The reliance on a non-standard authentication mechanism introduces significant security risks. It is imperative that administrators update to the patched version to restore standard security protections and mitigate the risk of unauthorized account access.