Contest Gallery < 13.1.0.7 - Authenticated Email Address Disclosure

2021-11-01 00:00
WPScanTeam

Strategic Overview

Status
Patched in 13.1.0.7
Affected Plugin
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
Affected Version
< 13.1.0.7
CVSS
4.3Medium
Weakness type
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
CVE
CVE pending
View all Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe vulnerabilities

At a glance

This record tracks a medium-severity Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the Contest Gallery WordPress plugin, affecting versions < 13.1.0.7. It carries a CVSS score of 4.3 (reachable over the network; low attack complexity). Exploitation requires an authenticated account. The issue is fixed in version 13.1.0.7; sites on affected versions should update now. Disclosed November 2021, reported by WPScanTeam.

Vulnerability Overview

The Contest Gallery plugin for WordPress is vulnerable to Sensitive Data Exposure in versions before 13.1.0.7 via the cg_remove_not_required_coded_csvs function due to insufficient capability checks. This makes it possible for authenticated attackers with subscriber-level privileges and above to extract sensitive data including usernames and email addresses.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Reaching this weakness in Contest Gallery < 13.1.0.7 takes any authenticated account. Sensitive information exposure means data the application intended to keep internal is returned to a caller who should not be able to see it.

The disclosed data — credentials, tokens, customer records or internal paths — is usually worth more as material for a follow-up attack than as an end in itself. For Contest Gallery the fix is 13.1.0.7: builds < 13.1.0.7 are affected, anything from 13.1.0.7 onward is not.

Remediation

Update to version 13.1.0.7, or a newer patched version

How does WordSec protect against this?

The fix is the thing that ends this: Contest Gallery 13.1.0.7 closes this, and updating the plugin is the step that ends it.

  • Alerts

External References

https://www.wordfence.com/threat-intel/vulnerabilities/id/7759b209-4211-4ee5-ae7a-42645f5d5e96

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C