CVE-2026-4021: Privilege Escalation in Contest Gallery WordPress Plugin

The core of this vulnerability lies in the plugin's email confirmation handler and an unauthenticated login endpoint. Specifically, the users-registry-check-after-email-or-pin-confirmation.php file uses the user's email string directly within a WHERE ID = %s clause, allowing an attacker to manipulate the query. Combined with the unauthenticated key-based login endpoint in ajax-functions-frontend.php, an attacker can register with a crafted email that includes the target user's ID, effectively impersonating that user. If the RegMailOptional=1 setting is enabled, this attack becomes even easier. Successful exploitation grants the attacker full administrative privileges, enabling them to modify site content, install malicious plugins, and compromise sensitive data.

1. Reserved2026-03-11
2. Published2026-03-23
3. Modified2026-04-08
4. EPSS updated2026-03-31

The primary mitigation for CVE-2026-4021 is to immediately upgrade the Contest Gallery plugin to version 28.1.6 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider temporarily disabling the RegMailOptional setting. While this doesn't directly address the authentication bypass, it significantly reduces the attack surface. Monitor WordPress access logs for suspicious registration attempts, particularly those involving unusual email addresses. Implement a Web Application Firewall (WAF) with rules to block requests to the vulnerable endpoints (users-registry-check-after-email-or-pin-confirmation.php and ajax-functions-frontend.php) with crafted email parameters. After upgrading, confirm the fix by attempting to register a new user with a crafted email containing a numeric user ID to verify that the authentication bypass is no longer possible.

Active installs

1KKnown

Plugin rating