Description
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Contest Gallery | < 33.0.1 | 33.0.1 |
References
- https://wpscan.com/vulnerability/13853303-741e-4f87-8543-d5d825d20e8e/ exploit vdb-entry technical-description