CVE-2024-11103Active Exploitation(contest-gallery / contest_gallery)

LOWCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for contest-gallery contest_gallery systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

The Contest Gallery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 24.0.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

contest-gallery CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Patch / fix

https://plugins.trac.wordpress.org/changeset/3196011/contest-gallery/tags/24.0.8/v10/v10-admin/users/frontend/login/ajax/users-login-check-ajax-lost-password.php?old=3190068&old_path=contest-gallery%2Ftags%2F24.0.7%2Fv10%2Fv10-admin%2Fusers%2Ffrontend%2Flogin%2Fajax%2Fusers-login-check-ajax-lost-password.php

Vendor / third-party advisories

https://www.wordfence.com/threat-intel/vulnerabilities/id/0df7f413-2631-46d9-8c0b-d66f05a02c01?source=cve

Other references

Weakness type (CWE)

CWE-640

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

contest_gallery

Threat summary

Active exploitation appears in 1 classified signals
1 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Affected systems

Vendors

contest-gallery

Products

contest_gallery

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Active Exploitation

1100.0%

Referenced assets1 URL

By indicator

https://zerodaysignal.com/vulnerability/CVE-2024-11103

Full discourse1 post

0day Signal@0dayPublishing183d
Active Exploitation
🚨 CVE-2024-11103: Contest Gallery <= 24.0.7 - Unau... Zero validation on password reset = instant admin takeover on 100k+ WordPress sites running this plugin - pure unauthen... https://zerodaysignal.com/vulnerability/CVE-2024-11103 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE‑2024‑11103, a flaw in Contest Gallery allowing unrestricted admin takeover via password reset, reportedly affecting over 100,000 WordPress sites. No PoC, exploit code, or patch is provided.
0000030
204 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	contest-gallery	contest_gallery	-	wordpress	-

Explore more

Back to dashboard contest-gallery CVEs contest_gallery vulnerabilities