# Contest Gallery <= 34.0.0 - Unauthenticated Voting Restriction Bypass via IP Address Spoofing

- **ID:** WPSEC-2026-0783
- **Plugin:** Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe (`contest-gallery`), https://wordpress.org/plugins/contest-gallery/
- **Affected versions:** all versions before 34.0.1
- **Fixed in:** 34.0.1 (Update to 34.0.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-348
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/contest-gallery
- **Fix released:** 2026-10-11
- **Published:** 2026-10-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0783/

## Description

The Contest Gallery plugin for WordPress is vulnerable to Voting Restriction Bypass via IP address spoofing in all versions up to, and including, 34.0.0, due to the cg_get_user_ip() function trusting client-supplied HTTP headers such as Client-IP and X-Forwarded-For when it works out the voter's IP address. This makes it possible for unauthenticated attackers to spoof their IP address and get around the IP-based voting limits (one vote per entry, votes per user, votes per time interval), and so manipulate contest results in galleries that use IP-based voting restrictions.

## References

- https://wpsec.com/vuln/WPSEC-2026-0783/
- https://plugins.svn.wordpress.org/contest-gallery/tags/34.0.1/
- https://wordpress.org/plugins/contest-gallery/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0783/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.