PT-2026-27894 · Unknown · Contest Gallery

Published 2026-03-25 · Updated 2026-03-30 · CVE-2026-25035

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contest Gallery versions prior to 28.1.2.3

Description A flaw exists in Contest Gallery that allows for authentication bypass. This allows for authentication abuse by utilizing an alternate path or channel.

Recommendations Update Contest Gallery to version 28.1.2.3 or later.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-25035

Affected Products

Contest Gallery

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-25035 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/contest-gallery/vulnerability/wordpress-contest-gallery-plugin-28-1-2-2-account-takeover-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2038517024234848624 · Twitter Post