An authenticated arbitrary file overwrite vulnerability in the Contest Gallery WordPress plugin allows remote attackers to potentially achieve remote code execution, posing a high risk to site integrity.

The plugin fails to perform adequate path validation on the baseUrlForFacebook parameter, which permits an authenticated attacker with subscriber-level privileges to overwrite critical system files. This flaw is classified under CWE-434, and when specific environmental conditions are met, it can be leveraged to execute arbitrary code on the underlying server.

Successful exploitation allows an attacker to overwrite arbitrary files on the WordPress installation, which can lead to complete server compromise through remote code execution. Given the CVSS score of 8.8, this vulnerability carries a high severity, as it facilitates unauthorized access, potential data theft, and total loss of system availability for the affected WordPress instance.

Immediate Action: Since a specific patch version is currently unavailable, administrators should immediately deactivate or remove the Contest Gallery plugin until a secure update is released by the vendor.

Proactive Monitoring: Monitor server logs for suspicious file write operations or unexpected modifications to configuration files, particularly within the WordPress directory structure.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests containing path traversal sequences or unauthorized modifications to plugin parameters.

Public Exploit Available: No (exploit_available: false)

Due to the severity of the potential impact, organizations must treat this vulnerability with urgency. If the plugin cannot be removed, ensure that user registrations are disabled to prevent untrusted parties from gaining the subscriber-level access required to trigger the exploit. Monitor vendor announcements closely for the release of a patched version to restore functionality safely.