Executive brief
Contest Gallery is a WordPress plugin used to manage and display image galleries on websites. The plugin contains a flaw that allows any authenticated user—even those with minimal permissions (Subscriber role)—to access and download the complete history of OpenAI API prompts that site administrators have used, potentially exposing confidential business information, client briefs, and proprietary instructions.
Technical details
The vulnerability is an authorization bypass (CWE-862) in the post_cg_get_openai_prompts AJAX handler. The handler lacks both capability checks and nonce verification, allowing any authenticated user to call it directly via admin-ajax.php. An attacker with a low-privilege Subscriber account can enumerate and exfiltrate the entire OpenAI prompt history from the wp_postmeta or similar storage table by varying the cg_start pagination parameter. No special preconditions beyond basic WordPress authentication are required. The vulnerability is fixed in version 30.0.7; prior versions are affected.
Affected products
- Contest Gallery Contest Gallery before 30.0.7
Timeline
- 2026-07-27: disclosed
- 2026-08-04: advisory: CVE-2026-16056 published
- 2026: patched: Fixed in version 30.0.7