Description

WordPress Plugin Contest Gallery-Photo Contest for WordPress is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently list all users from the blog, disclosing their username and email address. WordPress Plugin Contest Gallery-Photo Contest for WordPress version 13.1.0.6 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 13.1.0.7 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:71EB90F2-BAD2-4DE7-9335-02697AEE9FFE

https://plugins.svn.wordpress.org/contest-gallery/trunk/readme.txt

Related Vulnerabilities

WordPress Plugin Form Maker by 10Web-Mobile-Friendly Drag & Drop Contact Form Builder Unspecified Vulnerability (1.6.5)

Apache Tomcat version older than 6.0.14

WordPress Plugin VideoWhisper Video Presentation Multiple Cross-Site Scripting Vulnerabilities (3.25)

WordPress Plugin WP Product Review Lite Unspecified Vulnerability (3.7.6)

Oracle JRE CVE-2013-2445 Vulnerability (CVE-2013-2445)

Severity

High

Classification

CWE-264 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass