CVE-2026-107447

5.3 Moyenne

Publiée le 21/10/2026 à 11:17 · Modifiée le 21/10/2026 à 20:37 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.

Traduire en français

Produits concernés

Unknown Contest Gallery

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	contact@wpscan.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-290

Références

https://wpscan.com/vulnerability/9b848bb1-8be6-4ba6-9fd0-c45997502bce/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories