WordPress Plugin Vulnerabilities

Contest Gallery < 33.0.0 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter

Description

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite known files which may lead to remote code execution when certain preconditions are met.

Affects Plugins

Plugin icon
contest-gallery
Fixed in 33.0.0

References

CVE
CVE-2026-78088
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/af2115ba-5573-41ce-8d5a-58c57c65c75a

Miscellaneous

Original Researcher
mad4cyber
Verified
No
WPVDB ID
0634e38c-4793-4307-bb01-54f652ff9dfc

Timeline

Publicly Published
2026-09-15 (about 7 days ago)
Added
2026-09-15 (about 7 days ago)
Last Updated
2026-09-21 (about 18 hours ago)

Other

Published
Title
Published
2026-08-28
Title
Hash Form – Drag & Drop Form Builder < 1.4.3 - Unauthenticated Arbitrary File Upload
Published
2025-12-04
Title
PostGallery <= 1.12.5 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2024-12-30
Title
WPMasterToolKit < 1.14.0 - Authenticated (Admin+) Arbitrary File Upload
Published
2025-01-15
Title
Admin and Customer Messages After Order for WooCommerce < 13.3 - Authenticated (Subscriber+) Limited File Upload to Cross-Site Scripting
Published
2024-10-24
Title
SurveyJS: Drag & Drop WordPress Form Builder < 1.12.4 - Authenticated (Subscriber+) Arbitrary File Upload