CyberRota Analysis
AI-GeneratedThe Contest Gallery plugin for WordPress is vulnerable to unauthenticated arbitrary file overwrite due to inadequate validation of the 'baseUrlForFacebook' parameter, affecting all versions up to 32.0.1. This flaw allows authenticated attackers with subscriber-level access or higher to overwrite critical files, potentially leading to remote code execution under specific conditions. WordPress site administrators using this plugin should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite known files which may lead to remote code execution when certain preconditions are met.