Contest Gallery CVE-2026-16056

Exploitation requires a valid WordPress session with at minimum Subscriber-level privileges - confirmed by the CVSS vector PR:L, meaning unauthenticated visitors cannot exploit this. Additionally, the Contest Gallery plugin must be installed, active, and configured to use its OpenAI integration such that prompt history has been stored in the database. Sites with no registered users, closed registration, or no stored OpenAI prompt history have significantly reduced practical exposure. Exploitation is limited to: authenticated users with any registered WordPress role (Subscriber and above), the plugin's OpenAI feature must be in use, and the vulnerable handler must not be otherwise blocked by a WAF or security plugin. No specific platform or non-default server configuration is required beyond normal WordPress operation.

The CVSS 3.1 score of 4.3 (Medium) is well-calibrated for this issue: network-accessible (AV:N), low complexity (AC:L), but gated behind low-privilege authentication (PR:L), with impact limited strictly to confidentiality (C:L) and no integrity or availability consequences. EPSS at 0.13% (3rd percentile) signals very low probability of automated widespread exploitation. The vulnerability is absent from CISA KEV, confirming no observed active exploitation at time of analysis. However, a publicly available POC from WPScan does exist, lowering the bar for opportunistic abuse. Real-world risk is strongly context-dependent: sites whose OpenAI prompts contain proprietary business instructions, customer data, or confidential workflows face materially higher practical impact than the raw CVSS score implies. The CVSS vector and description are fully consistent - no conflicting signals observed.

An attacker registers a free Subscriber account on a WordPress site running a vulnerable version of Contest Gallery or reuses existing low-privileged credentials. Using the publicly available WPScan proof-of-concept, they send a direct authenticated HTTP request to the unprotected AJAX endpoint, which returns the site's complete stored OpenAI prompt history without any further authorization challenge.