CVE-2026-78088

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress contains an arbitrary file overwrite flaw in all versions up to and including 32.0.1, caused by insufficient file path validation of the 'baseUrlForFacebook' parameter. An attacker with only subscriber-level access or above (trivially obtained on sites with open registration) can send a crafted request to overwrite files at known locations on the server. Depending on which files are overwritten and whether certain preconditions are met, this can lead to remote code execution, site defacement, or destruction of critical files such as configuration. The vulnerability is rated high severity (CVSS 3.1: 8.8) and was assigned by Wordfence. No public proof-of-concept exists, it is not in the CISA Known Exploited Vulnerabilities catalog, and no exploitation has been reported in the wild.

What to do: Update Contest Gallery to the latest available version, which addresses the flaw (any release after 32.0.1). Until patched, consider deactivating the plugin or closing open user registration, since any subscriber-level account is sufficient to trigger the overwrite. Review web server and access logs for requests containing the 'baseUrlForFacebook' parameter and verify the integrity of files under the WordPress installation for unexpected modifications.