CVE-2026-107120

5.3 Moyenne

Publiée le 10/10/2026 à 08:16 · Modifiée le 13/10/2026 à 22:36 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.

Traduire en français

Produits concernés

Unknown Contest Gallery

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-287

Références

https://wpscan.com/vulnerability/13853303-741e-4f87-8543-d5d825d20e8e/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories