CVE-2026-16056

—

CVSS 3.1

4.3 medium

EPSS

<1%p6

Published

Aug 4, 2026 (Aug 4, 2026)

Modified

Aug 26, 2026

Description

The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.

Ecosystems: WordPress
Weakness: CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.