CVE-2026-107447
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Oct 21, 2026
Vendor
unknown
Description
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.