Contest Gallery login bypasses two-factor and brute-force controls
Contest Gallery before 30.0.7 authenticates its front-end login by checking the password and issuing a WordPress authentication cookie directly instead of using the standard WordPress login flow. Installed brute-force protection and two-factor authentication therefore do not run. An unauthenticated attacker can make unlimited password guesses against any account and, after finding a valid password, receive a session without completing the second factor, including for an administrator. This unscored record received deeper review because it is an authentication-control bypass; the CNA does not disclose the front-end route or parameters.
- Component
- Contest Gallery
- Plugin slug
contest-gallery- Affected
- < 30.0.7
- Safe version
30.0.7- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 60 known issues for this plugin.
Update, patch or deactivate.
Update Contest Gallery to 30.0.7 or later. Review front-end login traffic for sustained guessing, reset credentials for targeted users and invalidate privileged sessions if a vulnerable release was exposed.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Gallery WordPress plugin before 30.0.7 and enables unlimited, unthrottled password guessing against any account (including administrators) up to full account takeover.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H