What is the CVSS score of CVE-2026-16055?

CVE-2026-16055 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Contest Gallery are affected by CVE-2026-16055?

Contest Gallery WordPress plugin (versions before 30.0.7) includes a custom login system that bypasses WordPress security layers, eliminating brute-force protection and two-factor authentication.. A patch is available.

Is there a public PoC exploit available for CVE-2026-16055?

Yes, a public proof-of-concept exploit is available for CVE-2026-16055. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-16055?

Within 24 hours: Inventory all WordPress installations using Contest Gallery and immediately update to version 30.0.7 or later; disable the plugin if the patched version is not yet available. Within 7 days: Review server logs for brute-force login attempts during the past 60 days and check for suspicious admin account activity; reset all administrator passwords as a precaution. Within 30 days: Audit user access logs for any unauthorized account creation or configuration changes during the vulnerability window; verify WordPress security plugins are functioning correctly and confirm no residual unauthorized access remains.

Contest Gallery CVE-2026-16055

EUVD-2026-53121 HIGH

Improper Authentication (CWE-287)

2026-08-05 WPScan

GHSA-p2hg-mp68-hg8x

WordPress Authentication Bypass Contest Gallery Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Front-end login endpoint is network-accessible with no authentication prerequisite; brute-force attempt has no technical complexity once a username is known, yielding AC:L and PR:N rather than reported AC:H/PR:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 15:26 vuln.today

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Gallery WordPress plugin before 30.0.7 and enables unlimited, unthrottled password guessing against any account (including administrators) up to full account takeover.

AnalysisAI

Contest Gallery WordPress plugin before version 30.0.7 implements a custom front-end login mechanism that issues authentication cookies directly after password validation, entirely bypassing WordPress's standard authentication pipeline. This architectural shortcut renders all brute-force protection plugins and two-factor authentication plugins completely ineffective, allowing unlimited, unthrottled password guessing against any WordPress account - including administrators - up to full account takeover. A publicly available proof-of-concept exists per WPScan reporting, though CISA has not listed this in KEV and SSVC indicates no confirmed active exploitation at time of analysis.

Technical ContextAI

The Contest Gallery plugin (CPE: cpe:2.3:a:unknown:contest_gallery:*:*:*:*:*:*:*:*) exposes its own front-end login form and processes credential validation internally, issuing WordPress authentication cookies via a direct code path rather than calling wp-signon() or triggering WordPress's authenticate/wp_authenticate_user filter hooks. Any security plugin that hooks into the standard WordPress authentication pipeline - including brute-force throttling plugins such as Wordfence or WP Cerber, and 2FA plugins such as WP 2FA or Google Authenticator - is architecturally bypassed because their hooks are never invoked. CWE-287 (Improper Authentication) captures the root cause precisely: the password check is performed, but the implementation is incomplete in that it omits the layered security controls WordPress's native flow enforces before issuing a session cookie. The vulnerability affects all versions of the plugin from 0 up to but not including 30.0.7.

RemediationAI

Update the Contest Gallery WordPress plugin to version 30.0.7 or later, which is confirmed available from the vendor per the WPScan advisory at https://wpscan.com/vulnerability/fa83e5a0-ed6a-4043-8df3-8654bb354a99/. If immediate upgrade is not feasible, the most effective compensating control is to deactivate the Contest Gallery plugin entirely until patching is possible - this eliminates the vulnerable login endpoint at the cost of disabling all contest functionality. A secondary interim control is to implement IP-based rate limiting at the web server or WAF layer targeting the specific Contest Gallery login endpoint URL, which partially restores the brute-force throttling that the plugin architecture bypasses at the application layer; note this does not restore 2FA bypass protection. Network-level blocking of the front-end login path via application firewall rules is operationally low-impact if contestants can be directed to use the standard WordPress login instead during the interim period.