Vulnerabilities / Contest Gallery / WPSEC-2026-0783
Contest Gallery <= 34.0.0 - Unauthenticated Voting Restriction Bypass via IP Address Spoofing
Medium 5.3
CWE-348Fixed in 34.0.1
- ID
- WPSEC-2026-0783
- Plugin
- Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe (contest-gallery)
- Affected
- all versions before 34.0.1
- Remediation
- Update to 34.0.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-348
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-12
- Attack surface
- Contest Gallery on WPSec AttackSurface
- Fix released
- Published
Description
The Contest Gallery plugin for WordPress is vulnerable to Voting Restriction Bypass via IP address spoofing in all versions up to, and including, 34.0.0, due to the cg_get_user_ip() function trusting client-supplied HTTP headers such as Client-IP and X-Forwarded-For when it works out the voter's IP address. This makes it possible for unauthenticated attackers to spoof their IP address and get around the IP-based voting limits (one vote per entry, votes per user, votes per time interval), and so manipulate contest results in galleries that use IP-based voting restrictions.
References
- https://wpsec.com/vuln/WPSEC-2026-0783/
- https://plugins.svn.wordpress.org/contest-gallery/tags/34.0.1/
- https://wordpress.org/plugins/contest-gallery/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS