Contest Gallery (< 34.0.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/contest-gallery--34.0.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:59:19 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgContest Gallery WordPress Plugin: Arbitrary file upload and RCE (CVE-2026-118041)https://feed.craftedsignal.io/briefs/2026-11-contest-gallery-rce-cve-2026-118041/Wed, 11 Nov 2026 13:59:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-contest-gallery-rce-cve-2026-118041/The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacement feature, allowing authenticated users with Author-level access and above to write files with an arbitrary name and extension to a web-accessible directory and achieve Remote Code Execution.<p>The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacement feature. Authenticated users with Author-level access and above can write files with an arbitrary name and extension to a web-accessible directory. By overwriting the directory's protection file through the same flow, users can achieve Remote Code Execution.</p> highadvisory