# Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 34.0.2 - Unauthenticated Sensitive Information Exposure via Predictable Gallery ZIP Export File Name

- **ID:** WPSEC-2026-1973
- **Plugin:** Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe (`contest-gallery`), https://wordpress.org/plugins/contest-gallery/
- **Affected versions:** all versions before 34.0.3
- **Fixed in:** 34.0.3 (Update to 34.0.3 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-330
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/contest-gallery
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1973/

## Description

The Contest Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure via the gallery 'Zip all files' export in all versions up to, and including, 34.0.2 due to the ZIP archive of all original gallery uploads being stored at a public URL whose name is derived from md5 of the database prefix and the password hash of the user matching the site's admin e-mail. When the admin e-mail does not match any user account, the name falls back to md5 of the database prefix alone, which is easily guessed. This makes it possible for unauthenticated attackers to download every original file uploaded to a gallery once an administrator has generated the ZIP export and this configuration applies.

## References

- https://wpsec.com/vuln/WPSEC-2026-1973/
- https://plugins.svn.wordpress.org/contest-gallery/tags/34.0.3/
- https://wordpress.org/plugins/contest-gallery/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1973/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.