Contest Gallery CVE-2026-16057

Exploitation requires an authenticated WordPress account at the Author level or higher (Subscriber and Contributor roles are not affected). The Contest Gallery plugin must be installed and activated on the target site. No special plugin configuration, feature flag, or non-default setting is required beyond the plugin being active. Limiting factors: unauthenticated external attackers cannot exploit this - a valid Author (or higher) account on the target site is mandatory. WordPress sites where all Author-level and above accounts are fully trusted by site operators carry no realistic insider-threat risk from this flaw. Sites that disable user self-registration and tightly control account provisioning significantly reduce exposure.

The provided CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, score 6.5) contains a material inconsistency: the description states that Author-level users can exploit this flaw, yet PR:H denotes High Privileges (typically administrator-level). In WordPress's role hierarchy, Author is a standard authenticated content-creator role that maps to PR:L in CVSS terms, not PR:H. Using PR:L yields a base score of approximately 8.1 - a meaningful understatement of accessibility in the provided score. This discrepancy should be flagged to the scoring party for correction. The EPSS score of 0.13% (3rd percentile) suggests low automated exploitation probability at time of analysis, but this conflicts with the confirmed existence of a public exploit via WPScan - which typically indicates low-skill exploitability. The vulnerability is not listed in CISA KEV, so active exploitation in the wild is not confirmed. Real-world risk is concentrated in WordPress environments with multiple Author accounts that are not fully trusted, where content destruction would be the primary harm.

An attacker registers or compromises an Author-level account on a WordPress site running Contest Gallery before 30.0.7. They enumerate post IDs of content they do not own - trivial via WordPress's sequential post ID scheme or the REST API - and submit a crafted request to the plugin's post-deletion AJAX endpoint targeting those IDs. Because the handler only verifies the Author role membership and skips both the object-level capability check and nonce validation, the deletion executes immediately and permanently. A public exploit is available via WPScan, making this accessible to low-skilled attackers.