CVE-2026-107447 Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity

The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and...

CVE-2026-107447 Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity

The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and...

CVE-2026-107447

The Contest Gallery WordPress plugin (versions prior to 34.0.1 ) contains a vulnerability where it fails to reliably validate visitor identity for its one-vote-per-entry restriction. The flaw stems from the plugin trusting a client-supplied request header and an unbound client-generated token . T...