CVE-2026-4021
The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, and including, 28.1.5.
Published Mar 24, 2026 · updated Jun 17, 2026
The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, and including, 28.1.5. This is due to the email confirmation handler in using the user's email string in a clause instead of the numeric user ID, combined with an unauthenticated key-based login endpoint in . When the non-default setting is enabled, an attacker can register with a crafted email starting with the target user ID (e.g., ), trigger the confirmation flow to overwrite the admin's via MySQL integer coercion, and then use the AJAX action to authenticate as the admin without any credentials. This makes it possible for unauthenticated attackers to take over any WordPress administrator account and gain full site control.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 24, 2026 · NIST NVD
Detected
The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, and including, 28.1.5. This is due to the email confirmation handler in using the user's email string in a clause instead of the numeric user ID, combined with an unauthenticated key-based login endpoint in . When the non-default setting is enabled, an attacke
Jun 17, 2026 · NIST NVD
Updated
The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, and including, 28.1.5. This is due to the email confirmation handler in using the user's email string in a clause instead of the numeric user ID, combined with an unauthenticated key-based login endpoint in . When the non-default setting is enabled, an attacke
Sources
- CVE.orgVulnerability recordCVE-2026-4021
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-4021
The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, and including, 28.1.5. This is due to the email confirmation handler in using the
nvd.nist.gov