4.3
Medium
CVE-2026-16056 The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its…
Description
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Contest Gallery 30.0 | earliest → < 30.0.7 | 30.0.7 |
Other CVEs of Contest Gallery
The 21 CVEs of Contest Gallery →
CVE-2026-107447
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its…
5.3
Medium
CVE-2026-107120
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end…
5.3
Medium
CVE-2026-16055
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress…
7.5
High
CVE-2026-16057
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its…
6.5
Medium