CVE-2026-4021: 
WordPress vulnerability analysis and mitigation

CVE-2026-4021 is an authentication bypass vulnerability in the Contest Gallery plugin for WordPress that allows unauthenticated attackers to take over administrator accounts and gain full site control. It affects all versions of the plugin up to and including 28.1.5, and was published on March 24, 2026. The vulnerability was discovered and assigned by Wordfence. It carries a CVSS v3.1 base score of 8.1 (High) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-287 (Improper Authentication) and stems from two compounding flaws in the plugin's user registration flow. First, the email confirmation handler in users-registry-check-after-email-or-pin-confirmation.php uses the user's email string in a WHERE ID = %s SQL clause instead of the numeric user ID, enabling MySQL integer coercion — when an email like 1poc@example.test is provided, MySQL coerces the leading 1 to match user ID 1 (the admin). Second, an unauthenticated key-based login endpoint (post_cg1l_login_user_by_key AJAX action) in ajax-functions-frontend.php allows login using only an activation key. Exploitation requires the non-default RegMailOptional=1 setting to be enabled, which elevates the attack complexity. An attacker registers with a crafted email, triggers the confirmation flow to overwrite the admin's user_activation_key, and then uses the AJAX login endpoint to authenticate as the administrator without credentials (Wordfence, WordPress Trac).

Successful exploitation grants an unauthenticated attacker full administrative control over the affected WordPress site. This enables access to all sensitive site data, modification of website content, installation of malicious plugins or themes, creation of additional administrator accounts, site defacement, and potential launching of further attacks against site visitors. The confidentiality, integrity, and availability of the entire WordPress installation are all fully compromised (Wordfence).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.142%, indicating a currently low probability of exploitation in the near term. The vulnerability requires the non-default RegMailOptional=1 setting to be enabled, which limits the attack surface to a subset of installations. No threat actor attribution or CISA KEV catalog listing has been identified. The vulnerability has been detected by Qualys application security scanning (Qualys).

1. Reconnaissance: Identify WordPress sites running the Contest Gallery plugin (versions ≤ 28.1.5) with user registration enabled. Confirm the RegMailOptional=1 setting is active by attempting to register without email verification or by observing registration behavior.
2. Identify target admin user ID: Determine the WordPress administrator's user ID (typically 1 for the primary admin) by observing publicly accessible author pages (e.g., /?author=1) or other enumeration techniques.
3. Register with crafted email: Submit a new user registration to the site using an email address that begins with the target admin's user ID followed by arbitrary characters (e.g., 1poc@attacker.test). This causes MySQL integer coercion in the WHERE ID = %s query to match the admin account.
4. Trigger email confirmation flow: Initiate the email/PIN confirmation process for the newly registered account. The vulnerable handler in users-registry-check-after-email-or-pin-confirmation.php will overwrite the admin's user_activation_key in the WordPress database with the attacker-controlled key.
5. Authenticate as admin via AJAX endpoint: Send a POST request to the WordPress AJAX endpoint invoking the post_cg1l_login_user_by_key action with the attacker-controlled activation key. The server authenticates the request as the administrator without requiring a password.
6. Achieve full site control: With an authenticated admin session, perform any privileged action — install backdoor plugins, create new admin accounts, exfiltrate data, or deface the site (Wordfence, WordPress Trac).

• Network: Unusual POST requests to WordPress AJAX endpoints (/wp-admin/admin-ajax.php) with action=post_cg1l_login_user_by_key from unauthenticated or unknown IP addresses; new user registrations with email addresses beginning with numeric digits (e.g., 1poc@..., 1admin@...).
• Logs: WordPress access logs showing registration attempts with numerically prefixed email addresses; repeated AJAX requests to admin-ajax.php with the post_cg1l_login_user_by_key action; unexpected admin session creation events in WordPress authentication logs.
• File System: Newly installed plugins or themes not authorized by site administrators; presence of web shells or backdoor files in the WordPress uploads or plugins directories.
• WordPress Database: Changes to the user_activation_key field in the wp_users table for administrator accounts (user ID 1) without a corresponding legitimate password reset; unexpected new administrator-level user accounts in wp_users.
• Process/Behavior: Unexpected admin-level actions in WordPress audit logs (e.g., plugin installs, user creation, settings changes) not attributable to known administrators (Wordfence).

Update the Contest Gallery plugin to version 28.1.6 or later, which addresses the vulnerability by correcting the SQL query to use the numeric user ID instead of the email string (WordPress Trac Changeset). As an immediate workaround, disable the RegMailOptional=1 setting if it is currently enabled, as this configuration is required for exploitation. Additionally, consider temporarily disabling user registration on affected sites until patching is complete. After patching, review all WordPress administrator accounts and user activity logs for signs of unauthorized access or newly created admin accounts during the vulnerability window (Wordfence).

Wordfence, which discovered and reported the vulnerability, published details in their weekly WordPress vulnerability report for the week of March 23–29, 2026 (Wordfence Blog). The vulnerability was also noted by Red Hat's CVE tracking and picked up by security aggregators including RedPacket Security and Qualys. Social media coverage was limited to automated security alert accounts on Mastodon. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability aggregation.