CVE-2026-16055

The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Gallery WordPress plugin before 30.0.7 and enables unlimited, unthrottled password guessing against any account (including administrators) up to full account takeover.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.30% chance of exploitation in the next 30 days, 23th percentile

Published

2026-08-05

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/fa83e5a0-ed6a-4043-8df3-8654bb354a99/

References

• CVE Record
• NVD entry

Related

• CVE-2026-16054
• CVE-2026-16056
• CVE-2026-16051
• CVE-2026-16057
• CVE-2026-16042
• CVE-2026-16058