# CVE-2026-107447: Contest Gallery WordPress plugin vote restriction bypass

Source: https://junglewise.ai/threats/cve-2026-107447-the-contest-gallery-wordpress-plugin-before-34-0-1-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-107447 · Severity: medium · CVSS 5.3 · Published 2026-10-21

Contest Gallery is a WordPress plugin that lets websites run voting contests on entries. The plugin fails to properly verify who is casting votes, allowing anyone to vote multiple times for the same entry by spoofing their identity, artificially inflating vote counts and compromising contest fairness.

Technologies: [Contest Gallery](https://junglewise.ai/threats/technologies/contest-gallery). Vendors: [Contest Gallery](https://junglewise.ai/threats/vendors/contest-gallery).

## Quick answers

**Is CVE-2026-107447 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107447 being exploited in the wild.

**How severe is CVE-2026-107447?** Medium severity, with a CVSS score of 5.3, published 21 October 2026.

**Which products and versions are affected?** Contest Gallery before 34.0.1.

**Is there a fix for CVE-2026-107447?** Yes: fixed in 34.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107447 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-107447?** Check whether you run Contest Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 34.0.1

## Technical details

The plugin trusts unvalidated client-supplied request headers and client-generated tokens to enforce one-vote-per-entry restrictions, allowing unauthenticated attackers to bypass the voting limit via request manipulation. An attacker can cast unlimited votes for a single contest entry without authentication or user interaction by forging the voter identity token.

## Affected products

- Contest Gallery Contest Gallery before 34.0.1

## Timeline

- 2026-10-19: disclosed
- 2026-10-21: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/9b848bb1-8be6-4ba6-9fd0-c45997502bce/](https://wpscan.com/vulnerability/9b848bb1-8be6-4ba6-9fd0-c45997502bce/)

## Related threats

- [Contest Gallery WordPress plugin missing authorization in OpenAI prompt handler](https://junglewise.ai/threats/cve-2026-16056-contest-gallery-wordpress-plugin-missing-authorization-in-openai)
- [Contest Gallery WordPress plugin privilege escalation](https://junglewise.ai/threats/cve-2026-12165-contest-gallery-wordpress-plugin-privilege-escalation)
- [Contest Gallery improper input validation in WordPress plugin](https://junglewise.ai/threats/cve-2026-42657-contest-gallery-improper-input-validation-in-wordpress-plugin)
- [Contest Gallery SQL injection in form_input parameter](https://junglewise.ai/threats/cve-2026-8912-contest-gallery-sql-injection-in-form-input-parameter)