What is the CVSS score of CVE-2026-16057?

CVE-2026-16057 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-16057?

Yes, a public proof-of-concept exploit is available for CVE-2026-16057. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-16057?

Yes, a patch is available for CVE-2026-16057. Update the affected software to the latest version immediately.

Contest Gallery CVE-2026-16057

EUVD-2026-52162 MEDIUM

Missing Authorization (CWE-862)

2026-08-03 WPScan

GHSA-pwq7-3xxm-qxqg

WordPress Authentication Bypass Contest Gallery Unknown

6.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Author-level WordPress accounts are PR:L not PR:H; permanent post deletion warrants I:H and A:H with no confidentiality impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:26 vuln.today

CVSS changed

Aug 04, 2026 - 18:22 NVD

6.5 (MEDIUM)

Patch available

Aug 03, 2026 - 07:01 EUVD

CVE Published

Aug 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 06:00 cve.org

MEDIUM 6.5

DescriptionCVE.org

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.

AnalysisAI

Post-deletion authorization bypass in the Contest Gallery WordPress plugin before 30.0.7 allows any authenticated Author-level or higher user to permanently delete arbitrary posts, pages, and other WordPress content they do not own. The plugin's post-deletion AJAX handler enforces only a coarse role-membership test, entirely omitting per-object capability verification and nonce validation - the two controls that WordPress's built-in permission model relies on to prevent cross-user destructive actions. A public exploit is available via WPScan, lowering the skill barrier; though EPSS is low at 0.13%, any multi-author site with untrusted Author accounts faces real and irreversible content destruction risk.

Technical ContextAI

Contest Gallery (CPE: cpe:2.3:a:unknown:contest_gallery:*:*:*:*:*:*:*:*) is a WordPress plugin for running photo contests. The vulnerability is rooted in CWE-862 (Missing Authorization): the plugin's post-deletion handler validates only that the requesting user holds the Author role or higher, without calling WordPress's capability functions (e.g., delete_others_posts) on the specific target post, and without verifying a nonce token tied to the user session. WordPress's capability system is designed to enforce object-level ownership - a capability check alone is insufficient without scoping it to the specific object (post ID) being acted upon. The absent nonce check additionally opens the handler to CSRF-style abuse. All plugin versions from 0 up to (not including) 30.0.7 are affected.

RemediationAI

Upgrade the Contest Gallery WordPress plugin to version 30.0.7 or later, which contains the vendor-released patch addressing the missing authorization and nonce checks. Administrators can apply the update via the WordPress admin dashboard under Plugins > Updates, or via WP-CLI with 'wp plugin update contest-gallery'. If immediate patching is not feasible, the most targeted compensating control is to audit all accounts holding the Author role or higher and demote any untrusted users to Contributor - Contributors cannot independently publish content and are not affected by this handler. Note that demoting Authors to Contributors will require an Editor or Administrator to approve their submissions before publishing, which may disrupt existing workflows. Disabling the Contest Gallery plugin entirely until patching is possible is the most complete interim mitigation, with the trade-off of removing gallery/contest functionality. Advisory references: https://wpscan.com/vulnerability/77b00d40-7188-466e-b021-105f7a91f89e/ and https://nvd.nist.gov/vuln/detail/CVE-2026-16057.