7.5
High
CVE-2026-16055 The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress…
Description
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Gallery WordPress plugin before 30.0.7 and enables unlimited, unthrottled password guessing against any account (including administrators) up to full account takeover.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Contest Gallery 30.0 | earliest → < 30.0.7 | 30.0.7 |
References
- wpscan.com wpscan.com
Timeline
- Published
- Last modified
Other CVEs of Contest Gallery
The 21 CVEs of Contest Gallery →
CVE-2026-107447
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its…
5.3
Medium
CVE-2026-107120
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end…
5.3
Medium
CVE-2026-16056
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its…
4.3
Medium
CVE-2026-16057
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its…
6.5
Medium