Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-25035 EUVD-2026-15635GHSA-4f6x-h73m-pq6f

WordPress Contest Gallery plugin <= 28.1.2.2 - Account Takeover vulnerability

Published Mar 25, 2026 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Authentication Abuse.This issue affects Contest Gallery: from n/a through <= 28.1.2.2.

Affected products

VendorProductAffectedFixed
Wasiliy Strecker / ContestGallery developer Contest Gallery ≤ 28.1.2.2 —

References