CVE-2026-42680: WordPress Contest Gallery Pro plugin <= 29.0.1 - Privilege Escalation vulnerability

Synopsis

A privilege escalation vulnerability affects the Contest Gallery Pro WordPress plugin at version 29.0.1 and below. It is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable by any remote attacker. Successful exploitation allows an attacker to elevate their account privileges, gain full read, write, and availability control over affected data and systems. No fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected WordPress service over the network; no local access or physical proximity is required.

• AuthenticationNot required

  No account or credentials of any kind are needed to trigger the privilege escalation.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the exploit executes without any victim action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental preconditions.

Blast Radius

• An unauthenticated attacker gains elevated or administrative privileges on the WordPress installation, enabling full control over site content and settings.
• With elevated privileges, the attacker reads sensitive stored data including user records, session tokens, and any private media or contest entries managed by the plugin.
• The attacker can modify or delete persisted database rows, including user roles, plugin configuration, and uploaded contest content.
• The attacker can disrupt site availability by altering core configuration or injecting content that renders the site inoperable.