Contest Gallery < 24.0.8 - Unauthenticated Arbitrary Password Reset

Description

The plugin is vulnerable to privilege escalation via account takeover due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.