Skip to content
fr Sign in
6.5 Medium

CVE-2026-16057 The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its…

Description

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.

Affected products and versions

Product Affected versions Fixed in
Contest Gallery 30.0 earliest → < 30.0.7 30.0.7

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Contest Gallery

The 21 CVEs of Contest Gallery →
CVE-2026-107447 The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its… 5.3 Medium CVE-2026-107120 The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end… 5.3 Medium CVE-2026-16055 The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress… 7.5 High CVE-2026-16056 The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its… 4.3 Medium
Track this CVE