Contest Gallery CVE-2026-16055

The Contest Gallery WordPress plugin must be installed, activated, and its front-end login feature accessible on the target site - this is not a default WordPress configuration but is inherent to Contest Gallery deployments that use its login form. The target site must be running a plugin version below 30.0.7. The attacker must know or enumerate a valid WordPress username or email address to target; without a valid target identity, password guessing has no defined surface. Exploitation is limited to sites where Contest Gallery's front-end login path is reachable over the network. The CVSS PR:L designation implies low-privilege credentials may be required, but this conflicts with the description's framing of unlimited guessing 'against any account' - this ambiguity should be clarified with the vendor before making access-control-based risk decisions. SSVC Automatable: no indicates the attack does not trivially scale to mass automated targeting, likely reflecting the username enumeration prerequisite and per-site variation in the login endpoint path.

The reported CVSS 7.5 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) warrants scrutiny: AC:H and PR:L are inconsistent with the description, which states that attackers can perform unlimited password guessing against any account without requiring existing credentials. The AC:H designation may reflect the need to enumerate a valid username first, and PR:L may reflect an assumption about needing to know the Contest Gallery login endpoint path - but neither constitutes a meaningful technical barrier. EPSS is very low at 0.19% (9th percentile), and SSVC confirms Exploitation: none with Automatable: no, indicating no evidence of mass exploitation and inherent friction in chaining attacks at scale. However, the SSVC Technical Impact is rated total, accurately reflecting that successful exploitation yields full account takeover including administrator-level access. The presence of a publicly available POC from WPScan elevates real-world risk above what raw EPSS or SSVC exploitation status alone would suggest. The gap between the reported CVSS metrics and the description's implied severity is a data quality concern - verify the PR and AC assignments with the vendor or WPScan advisory.

An attacker who has identified a WordPress site running Contest Gallery navigates to the plugin's front-end login form and submits automated credential attempts against a known or enumerated administrator username, such as 'admin', at high speed. Because the plugin processes authentication independently of WordPress's hook system, Wordfence, WP Cerber, or any installed 2FA plugin receives no signal and applies no lockout or challenge - all attempts pass unchallenged until the correct password is found. A publicly available POC from WPScan demonstrates this credential stuffing or dictionary-attack path, lowering the skill threshold for exploitation.