CVE-2026-16056: Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts
Published Aug 4, 2026
·Updated
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.
Affected Software
1 affected component
WordPress Contest Gallery<30.0.7
Event History
Aug 4, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-16056?
The severity of CVE-2026-16056 is rated as risk 48.
2
How do I fix CVE-2026-16056?
To fix CVE-2026-16056, update the Contest Gallery WordPress plugin to version 30.0.7 or later.
3
What exposure does CVE-2026-16056 create for my website?
CVE-2026-16056 allows authenticated users with Subscriber roles to access the site's entire stored OpenAI prompt history.
4
Which versions of the Contest Gallery plugin are affected by CVE-2026-16056?
CVE-2026-16056 affects all versions of the Contest Gallery plugin prior to 30.0.7.
5
What kind of authentication is required to exploit CVE-2026-16056?
CVE-2026-16056 can be exploited by any authenticated user, even those with the lowest Subscriber role.