Vulnerability · Published Aug 3, 2026 · Assigned by WPScan
CVE-2026-16057Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library
Medium 6.5
In plain English
A medium-severity missing authorization in Contest Gallery from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 63.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Contest Gallery | 0 – before 30.0.7 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
References
- https://wpscan.com/vulnerability/77b00d40-7188-466e-b021-105f7a91f89e/ exploit, vdb-entry, technical-description