CVE-2026-4021

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4021", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-11T20:10:49.726Z", "datePublished": "2026-03-23T23:25:50.405Z", "dateUpdated": "2026-04-08T17:32:30.381Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:30.381Z"}, "affected": [{"vendor": "contest-gallery", "product": "Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "28.1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, and including, 28.1.5. This is due to the email confirmation handler in `users-registry-check-after-email-or-pin-confirmation.php` using the user's email string in a `WHERE ID = %s` clause instead of the numeric user ID, combined with an unauthenticated key-based login endpoint in `ajax-functions-frontend.php`. When the non-default `RegMailOptional=1` setting is enabled, an attacker can register with a crafted email starting with the target user ID (e.g., `1poc@example.test`), trigger the confirmation flow to overwrite the admin's `user_activation_key` via MySQL integer coercion, and then use the `post_cg1l_login_user_by_key` AJAX action to authenticate as the admin without any credentials. This makes it possible for unauthenticated attackers to take over any WordPress administrator account and gain full site control."}], "title": "Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f1b9725b-dee5-44ca-bb33-c6812fb76adc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/contest-gallery/trunk/v10/v10-admin/users/frontend/registry/users-registry-check-after-email-or-pin-confirmation.php#L153"}, {"url": "https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.4/v10/v10-admin/users/frontend/registry/users-registry-check-after-email-or-pin-confirmation.php#L153"}, {"url": "https://plugins.trac.wordpress.org/browser/contest-gallery/trunk/ajax/ajax-functions-frontend.php#L204"}, {"url": "https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.4/ajax/ajax-functions-frontend.php#L204"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/contest-gallery/tags/28.1.5&new_path=/contest-gallery/tags/28.1.6"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-287 Improper Authentication", "cweId": "CWE-287", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Supakiad S."}], "timeline": [{"time": "2026-03-11T20:26:17.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-23T11:19:11.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T18:43:36.134537Z", "id": "CVE-2026-4021", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T18:43:43.168Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4021", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-24T18:43:36.134537Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T18:43:39.268Z"}}], "cna": {"title": "Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion", "credits": [{"lang": "en", "type": "finder", "value": "Supakiad S."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "contest-gallery", "product": "Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "28.1.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-11T20:26:17.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-23T11:19:11.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f1b9725b-dee5-44ca-bb33-c6812fb76adc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/contest-gallery/trunk/v10/v10-admin/users/frontend/registry/users-registry-check-after-email-or-pin-confirmation.php#L153"}, {"url": "https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.4/v10/v10-admin/users/frontend/registry/users-registry-check-after-email-or-pin-confirmation.php#L153"}, {"url": "https://plugins.trac.wordpress.org/browser/contest-gallery/trunk/ajax/ajax-functions-frontend.php#L204"}, {"url": "https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.4/ajax/ajax-functions-frontend.php#L204"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/contest-gallery/tags/28.1.5&new_path=/contest-gallery/tags/28.1.6"}], "descriptions": [{"lang": "en", "value": "The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, and including, 28.1.5. This is due to the email confirmation handler in `users-registry-check-after-email-or-pin-confirmation.php` using the user's email string in a `WHERE ID = %s` clause instead of the numeric user ID, combined with an unauthenticated key-based login endpoint in `ajax-functions-frontend.php`. When the non-default `RegMailOptional=1` setting is enabled, an attacker can register with a crafted email starting with the target user ID (e.g., `1poc@example.test`), trigger the confirmation flow to overwrite the admin's `user_activation_key` via MySQL integer coercion, and then use the `post_cg1l_login_user_by_key` AJAX action to authenticate as the admin without any credentials. This makes it possible for unauthenticated attackers to take over any WordPress administrator account and gain full site control."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:30.381Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4021", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:32:30.381Z", "dateReserved": "2026-03-11T20:10:49.726Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-23T23:25:50.405Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe", "vendor": "contest-gallery", "versions": [{"lessThanOrEqual": "28.1.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, and including, 28.1.5. This is due to the email confirmation handler in `users-registry-check-after-email-or-pin-confirmation.php` using the user's email string in a `WHERE ID = %s` clause instead of the numeric user ID, combined with an unauthenticated key-based login endpoint in `ajax-functions-frontend.php`. When the non-default `RegMailOptional=1` setting is enabled, an attacker can register with a crafted email starting with the target user ID (e.g., `1poc@example.test`), trigger the confirmation flow to overwrite the admin's `user_activation_key` via MySQL integer coercion, and then use the `post_cg1l_login_user_by_key` AJAX action to authenticate as the admin without any credentials. This makes it possible for unauthenticated attackers to take over any WordPress administrator account and gain full site control."}, {"lang": "es", "value": "El plugin Contest Gallery para WordPress es vulnerable a una omisi\u00f3n de autenticaci\u00f3n que conduce a la toma de control de la cuenta de administrador en todas las versiones hasta la 28.1.5, inclusive. Esto se debe a que el gestor de confirmaci\u00f3n de correo electr\u00f3nico en `users-registry-check-after-email-or-pin-confirmation.php` utiliza la cadena de correo electr\u00f3nico del usuario en una cl\u00e1usula `WHERE ID = %s` en lugar del ID de usuario num\u00e9rico, combinado con un punto final de inicio de sesi\u00f3n basado en clave no autenticado en `ajax-functions-frontend.php`. Cuando la configuraci\u00f3n no predeterminada `RegMailOptional=1` est\u00e1 habilitada, un atacante puede registrarse con un correo electr\u00f3nico manipulado que comienza con el ID de usuario objetivo (p. ej., `1poc@example.test`), activar el flujo de confirmaci\u00f3n para sobrescribir la `user_activation_key` del administrador a trav\u00e9s de la coerci\u00f3n de enteros de MySQL, y luego usar la acci\u00f3n AJAX `post_cg1l_login_user_by_key` para autenticarse como administrador sin credenciales. Esto hace posible que atacantes no autenticados tomen el control de cualquier cuenta de administrador de WordPress y obtengan control total del sitio."}], "id": "CVE-2026-4021", "lastModified": "2026-06-17T10:55:52.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4021", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T18:43:36.134537Z", "version": "2.0.3"}}]}, "published": "2026-03-24T00:16:31.210", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.4/ajax/ajax-functions-frontend.php#L204"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.4/v10/v10-admin/users/frontend/registry/users-registry-check-after-email-or-pin-confirmation.php#L153"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/contest-gallery/trunk/ajax/ajax-functions-frontend.php#L204"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/contest-gallery/trunk/v10/v10-admin/users/frontend/registry/users-registry-check-after-email-or-pin-confirmation.php#L153"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?old_path=/contest-gallery/tags/28.1.5&new_path=/contest-gallery/tags/28.1.6"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f1b9725b-dee5-44ca-bb33-c6812fb76adc?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe", "source": "cna", "vendor": "contest-gallery"}, "product": "contest_gallery_\u2013_upload_&_vote_photos,_media,_sell_with_paypal_&_stripe", "vendor": "contest-gallery"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-24T03:54:40.758058+00:00", "value": {"mitigation_remediation": ["Upgrade Contest Gallery to version 28.1.6 or later.", "Disable the RegMailOptional option in the plugin settings (set to 0).", "Disable or restrict unauthenticated access to the login\u2011by\u2011key AJAX endpoint if possible.", "Verify that existing administrator accounts are no longer accessible via the compromised key mechanism.", "Monitor site logs for suspicious registration and login activity."], "summary": {"action": "Immediate Patch", "impact": "Admin Account Takeover"}, "threat_synthesis": {"affected_systems": "All installations of Contest Gallery plugin up to and including version 28.1.5 for WordPress sites are impacted. The vulnerability is tied to the specific files users-registry-check-after-email-or-pin-confirmation.php and ajax-functions-frontend.php within the plugin codebase.", "description_and_impact": "The Contest Gallery WordPress plugin allows attackers to assume the role of any site administrator without authentication. The vulnerability arises when the email confirmation mechanism uses the email string as a numeric ID in a database query, and a separate AJAX endpoint accepts an activation key for login. By registering a specially crafted email (e.g., one that begins with the target user\u2019s numeric ID) while the optional registration mail flag is enabled, an attacker can trigger a confirmation flow that coerces the integer value and writes a new activation key for the victim admin. The attacker then submits this key to the AJAX login endpoint and authenticates as the admin, gaining full control of the WordPress site. The effect is a complete escalation of privilege that compromises both confidentiality and integrity of site data.", "risk_and_exploitability": "The Security Scorecard assigns a CVSS score of 8.1, indicating high severity, while no EPSS score is available, making it unclear how frequently this bug is exploited in the wild. The flaw is not yet listed in CISA\u2019s Known Exploited Vulnerabilities (KEV) catalog. The known attack path requires an attacker to be able to register a new user on the target site and to have the RegMailOptional setting set to 1; this may limit the prevalence of the vulnerability but still poses a serious risk when the environment is configured for optional registration emails. Once the required conditions are in place, exploitation is straightforward, involving no credentials, a crafted email address, and a single AJAX request."}}}}, "created": "2026-03-24T10:29:54.032211+00:00", "updated": "2026-03-25T20:36:01.364755+00:00", "vendors": ["contest-gallery", "contest-gallery$PRODUCT$contest_gallery_\u2013_upload_&_vote_photos,_media,_sell_with_paypal_&_stripe", "wordpress", "wordpress$PRODUCT$wordpress"]}