{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-118041","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","state":"PUBLISHED","assignerShortName":"WPScan","dateReserved":"2026-10-27T15:05:31.497Z","datePublished":"2026-11-11T06:00:08.321Z","dateUpdated":"2026-11-11T06:00:08.321Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-11-11T06:00:08.321Z"},"title":"Contest Gallery < 34.0.3 - Author+ Arbitrary File Upload via Ecommerce Sale File Replacement","problemTypes":[{"descriptions":[{"description":"CWE-434 Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}]}],"affected":[{"vendor":"Unknown","product":"Contest Gallery","versions":[{"status":"affected","versionType":"semver","version":"0","lessThan":"34.0.3"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The Contest Gallery  WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacement feature, allowing authenticated users with Author-level access and above to write files with an arbitrary name and extension to a web-accessible directory and, by overwriting the directory's protection file through the same flow, achieve Remote Code Execution."}],"references":[{"url":"https://wpscan.com/vulnerability/d202d856-1eb5-47c8-b3cd-571e2073f3bf/","tags":["exploit","vdb-entry","technical-description"]}],"credits":[{"lang":"en","value":"Izzny","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}}}}