CVE-2026-78088 in Contest Gallery Plugin
Summary
by MITRE • 09/16/2026
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite known files which may lead to remote code execution when certain preconditions are met.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified within The Contest Gallery plugin for WordPress represents a critical security flaw rooted in insufficient validation of file path inputs during the handling of media uploads and configuration updates. Specifically, the issue resides in the processing of the baseUrlForFacebook parameter, which is intended to store or reference external resource paths but fails to adequately sanitize user-supplied data before it is written to server-side files. This lack of rigorous input validation allows an attacker with authenticated access at the subscriber level or higher to manipulate file system operations beyond their authorized scope. Although the vulnerability requires authentication, the low privilege threshold means that any registered user on a WordPress installation can potentially exploit this flaw, significantly expanding the attack surface compared to vulnerabilities requiring administrator-level privileges.
From a technical perspective, the core of the issue is an arbitrary file overwrite condition. By crafting specific requests containing maliciously formatted paths within the baseUrlForFacebook parameter, an attacker can direct the application to write data into predetermined locations on the web server's filesystem rather than in the intended directory structure. This capability bypasses standard WordPress security boundaries that typically restrict user uploads to wp-content/uploads directories or similar isolated areas. The ability to overwrite known files is particularly dangerous because it allows for precise targeting of critical system components, configuration files, or theme templates where specific content injection can trigger unintended execution behaviors.
The operational impact of this vulnerability extends beyond simple data integrity loss and poses a severe risk to the confidentiality, integrity, and availability of the affected WordPress site. If an attacker successfully overwrites a file such as a PHP template, plugin entry point, or configuration file with malicious code, they may achieve remote code execution on the underlying server. This preconditions for successful exploitation include having write access to the target directory via the application logic and ensuring that the overwritten file is subsequently executed by the web server. In many WordPress environments, this can lead to complete site compromise, allowing attackers to install backdoors, deface websites, steal sensitive user data, or use the compromised server as a pivot point for further network attacks.
This vulnerability aligns with CWE-434, which describes the unrestricted upload of files with dangerous types, and more specifically CWE-22, improper limitation of a pathname to a restricted directory, often leading to path traversal issues that facilitate file overwrites. In terms of offensive security frameworks, this behavior maps closely to ATT&CK technique T1505.003, Server Software Component: Web Shell, as the ultimate goal is typically to plant executable code for persistent access. It also relates to T1222, File and Directory Permissions Modification, if the attacker modifies permissions to facilitate further exploitation.
Mitigation strategies should focus on immediate remediation through software updates and defensive coding practices. The primary defense is to upgrade The Contest Gallery plugin to version 32.0.2 or later, where developers have addressed the insufficient file path validation in the baseUrlForFacebook parameter. For environments unable to update immediately due to compatibility constraints, administrators should implement strict input sanitization at the application layer, ensuring that all user-supplied paths are validated against a whitelist of allowed characters and directories. Additionally, enforcing least-privilege principles for database users and web server processes can limit the damage if an overwrite occurs by restricting write permissions to only necessary directories. Regular security audits and monitoring of file system changes can also aid in early detection of such exploitation attempts.