Skip to content
Threat Feed
critical advisory

Contest Gallery WordPress Plugin Authentication Bypass Vulnerability (CVE-2026-4021)

CVE-2026-4021 describes an authentication bypass vulnerability in the Contest Gallery plugin for WordPress, allowing unauthenticated attackers to gain admin access by manipulating the user activation key and using an AJAX login endpoint.

The Contest Gallery plugin for WordPress, versions up to and including 28.1.5, is vulnerable to a critical authentication bypass (CVE-2026-4021). This vulnerability stems from how the users-registry-check-after-email-or-pin-confirmation.php script handles email confirmations, combined with an unauthenticated key-based login endpoint in ajax-functions-frontend.php. If the RegMailOptional=1 setting is enabled (non-default), an attacker can register a new user account with a specially…

Detection coverage 2

Detect Contest Gallery Authentication Bypass Attempt via AJAX

high

Detects attempts to exploit CVE-2026-4021 by monitoring for suspicious POST requests to the WordPress AJAX endpoint with the 'post_cg1l_login_user_by_key' action.

sigma tactics: initial_access, privilege_escalation techniques: T1190 sources: webserver, linux

Detect User Registration with Crafted Email for Activation Key Overwrite

medium

Detects user registration attempts using crafted email addresses designed to overwrite the admin's activation key in the database via CVE-2026-4021.

sigma tactics: initial_access techniques: T1190 sources: webserver, linux

Detection queries are kept inside the platform. Get full rules →

Indicators of compromise

1

email