Contest Gallery WordPress Plugin: Arbitrary file upload and RCE (CVE-2026-118041)
The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacement feature, allowing authenticated users with Author-level access and above to write files with an arbitrary name and extension to a web-accessible directory and achieve Remote Code Execution.
CVE search metadata
CVE search record: CVE-2026-118041. Severity: high. CVSS: 8.8. KEV: no. Product: Contest Gallery (< 34.0.3). Brief: Contest Gallery WordPress Plugin: Arbitrary file upload and RCE (CVE-2026-118041). Brief link: https://feed.craftedsignal.io/briefs/2026-11-contest-gallery-rce-cve-2026-118041/
Triage facts
Revision 1- Applicability
- Contest Gallery (< 34.0.3)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 13:59 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacement feature. Authenticated users with Author-level access and above can write files with an arbitrary name and extension to a web-accessible directory. By overwriting the directory's protection file through the same flow, users can achieve Remote Code Execution.