{
 "id": "WPSEC-2026-1973",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1973/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1973/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1973/index.md",
 "title": "Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 34.0.2 - Unauthenticated Sensitive Information Exposure via Predictable Gallery ZIP Export File Name",
 "description": "The Contest Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure via the gallery 'Zip all files' export in all versions up to, and including, 34.0.2 due to the ZIP archive of all original gallery uploads being stored at a public URL whose name is derived from md5 of the database prefix and the password hash of the user matching the site's admin e-mail. When the admin e-mail does not match any user account, the name falls back to md5 of the database prefix alone, which is easily guessed. This makes it possible for unauthenticated attackers to download every original file uploaded to a gallery once an administrator has generated the ZIP export and this configuration applies.",
 "plugin": {
  "slug": "contest-gallery",
  "name": "Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe",
  "full_name": "Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe",
  "wordpress_org": "https://wordpress.org/plugins/contest-gallery/",
  "advisories_url": "https://wpsec.com/vuln/plugin/contest-gallery/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/contest-gallery"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-330"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "34.0.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 34.0.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "34.0.3",
 "remediation": "Update to 34.0.3 or later.",
 "fix_released": "2026-10-28T21:39:59+00:00",
 "published": "2026-10-29T21:49:27+00:00",
 "updated": "2026-10-29T17:44:33.221827+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1973/",
  "https://plugins.svn.wordpress.org/contest-gallery/tags/34.0.3/",
  "https://wordpress.org/plugins/contest-gallery/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/contest-gallery",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-29"
 }
}