PT-2026-67655 · WordPress · Contest Gallery
CVE-2026-16056
·
Published
2026-08-04
·
Updated
2026-08-04
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Contest Gallery versions prior to 30.0.7
Description
The plugin fails to perform capability or nonce checks in one of its handlers, specifically within the
post cg get openai prompts function. This allows any authenticated user, including those with Subscriber level permissions, to read the entire stored OpenAI prompt history of the site. A nonce is a unique token used to protect against cross-site request forgery (CSRF) attacks.Recommendations
Update to version 30.0.7 or later.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Contest Gallery