CVE-2026-42680

Vulnerability

An incorrect privilege assignment vulnerability exists in the Contest Gallery Pro WordPress plugin, affecting versions from n/a through 29.0.1. This flaw allows unauthorized privilege escalation by allowing a malicious actor with a low-privileged account to escalate their privileges to a higher level. [1]

Exploitation

To exploit this vulnerability, an attacker needs to have a low-privileged account on a WordPress site running the vulnerable plugin. The attack does not require any user interaction or special network position; it can be performed remotely. The specific sequence of steps is not disclosed, but the vulnerability can be triggered by manipulating privilege assignment mechanisms within the plugin.

Impact

Successful exploitation leads to privilege escalation, where an attacker can gain higher privileges, potentially reaching administrator-level access. This could allow the attacker to take full control of the website, including modifying content, installing malicious plugins, or accessing sensitive data.

Mitigation

The vulnerability is fixed in version 29.0.2 of Contest Gallery Pro. Users are strongly advised to update immediately. Patchstack has also issued a mitigation rule to block attacks until the update is applied. If unable to update, users should seek assistance from their hosting provider or web developer. [1]