A critical authentication bypass vulnerability in the Contest Gallery plugin for WordPress allows unauthenticated attackers to hijack administrator accounts and gain full site control.

The vulnerability exists in the email confirmation handler within users-registry-check-after-email-or-pin-confirmation.php, where improper handling of user ID inputs during registration allows for the manipulation of user activation keys. An unauthenticated attacker can exploit this via the post_cg1l_login_user_by_key AJAX action to authenticate as any site administrator.

Successful exploitation grants an attacker full administrative access to the WordPress environment. This results in complete site compromise, including the ability to exfiltrate sensitive data, inject malicious scripts, or distribute malware to visitors. The CVSS score of 8.1 reflects the high severity of this flaw, as it facilitates unauthorized access to critical administrative functions without requiring any prior credentials.

Immediate Action: Update the Contest Gallery plugin to version 28.1.6 or the latest available version immediately to patch the authentication logic.

Proactive Monitoring: Review WordPress administrative user lists for unauthorized account creations or unexpected modifications to existing administrator profiles.

Compensating Controls: If an immediate update is not possible, disable the plugin or ensure the RegMailOptional setting is not enabled, though updating remains the only effective remediation.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for total administrative takeover, organizations utilizing the Contest Gallery plugin must prioritize this update. Administrators should verify their current version and apply the patch to version 28.1.6 as soon as possible to prevent potential site hijacking.