Arbitrary File Overwrite in Contest Gallery WordPress Plugin

The Contest Gallery WordPress plugin is affected by a critical vulnerability, tracked as CVE-2026-78088, which enables arbitrary file overwrite. The flaw resides in the 'baseUrlForFacebook' parameter, which lacks sufficient validation. While initially described as unauthenticated, the vulnerability can be leveraged by any attacker with subscriber-level access or higher to overwrite arbitrary files on the underlying web server. By overwriting critical PHP files or configuration files, an attacker can facilitate remote code execution (RCE). This vulnerability affects all versions of the plugin up to and including 32.0.1. Defenders should treat this as a high-priority risk for any WordPress site utilizing this plugin, as it provides a direct pathway for full site compromise.

Impact

Successful exploitation of this vulnerability allows an attacker to overwrite sensitive files within the WordPress installation directory. This can lead to the execution of arbitrary code with the privileges of the web server user, resulting in full site takeover, data exfiltration, or the deployment of persistent backdoors. The scope of impact is limited to WordPress installations running the affected plugin versions.

Recommendation

• Update the Contest Gallery plugin to the latest available patched version immediately.
• Audit the WordPress installation directory for unauthorized changes to core files, particularly following any suspicious login activity.
• Restrict file system write permissions for the web server user to only those directories strictly required for operation, such as the /uploads folder.
• Monitor web access logs for requests containing unexpected directory traversal characters or malicious payloads targeting the 'baseUrlForFacebook' parameter.