CVE-2026-16056
Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts
- State
- Published
- Severity
- 4.3 Medium
- Published
- Aug 4, 2026
- Updated
- Aug 4, 2026
- Reserved
- Jul 17, 2026
Description
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
Contest GalleryUnknown |
|
References
- https://wpscan.com/vulnerability/53aec8d3-da17-4183-91b3-73b45681fd20/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.