CVE-2026-16055
High
Description
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Gallery WordPress plugin before 30.0.7 and enables unlimited, unthrottled password guessing against any account (including administrators) up to full account takeover.
SeverityHigh
CVSS7.5
Exploit probability—
ProductContest Gallery
PublishedAug 5, 2026
First seenAug 5, 2026
Weakness typeCWE-287Improper authentication
How to fix
Update
- Contest Gallery30.0.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Contest Gallery | v < 30.0.7 | 30.0.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.