Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 34.0.2 - Unauthenticated Sensitive Information Exposure via Predictable Gallery ZIP Export File Name
- ID
- WPSEC-2026-1973
- Plugin
- Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe (contest-gallery)
- Affected
- all versions before 34.0.3
- Remediation
- Update to 34.0.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-330
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-29
- Attack surface
- Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe on WPSec AttackSurface
- Fix released
- Published
Description
The Contest Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure via the gallery 'Zip all files' export in all versions up to, and including, 34.0.2 due to the ZIP archive of all original gallery uploads being stored at a public URL whose name is derived from md5 of the database prefix and the password hash of the user matching the site's admin e-mail. When the admin e-mail does not match any user account, the name falls back to md5 of the database prefix alone, which is easily guessed. This makes it possible for unauthenticated attackers to download every original file uploaded to a gallery once an administrator has generated the ZIP export and this configuration applies.
References
- https://wpsec.com/vuln/WPSEC-2026-1973/
- https://plugins.svn.wordpress.org/contest-gallery/tags/34.0.3/
- https://wordpress.org/plugins/contest-gallery/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS