CVE-2026-16055— Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login
Possible ATT&CK Techniques 3AI
T1059 · Command and Scripting Interpreter T1078 · Valid Accounts T1110 · Brute ForceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Contest Gallery | < 30.0.7 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-16055
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login
Source: CVE Program / CVE List V5
Vulnerability Description
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Gallery WordPress plugin before 30.0.7 and enables unlimited, unthrottled password guessing against any account (including administrators) up to full account takeover.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Contest Gallery 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Contest Gallery是WordPress基金会开源的一个管理竞赛作品的CMS组件。 WordPress Contest Gallery 30.0.7之前版本存在安全漏洞，该漏洞源于前端登录未经过标准WordPress认证流程，在密码检查后直接签发认证cookie，绕过已安装的暴力破解保护和双因素认证，可能导致针对任意账户（包括管理员）进行无限且无节制的密码猜测，直至完全接管账户。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Contest Gallery | 0 ~ 30.0.7 | - |
II. Public POCs for CVE-2026-16055
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16055
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-16055 (1)
- 🔗 Contest Gallery < 30.0.7 – Unauthenticated Login-Protection and 2FA Bypass via post_cg_login | CVE 2026-16055 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-08-05 · 24 CVEs total
| CVE-2026-16968 | GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users | |
| CVE-2026-17515 | MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per | |
| CVE-2026-16036 | miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding | |
| CVE-2025-15677 | GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories | |
| CVE-2026-14553 | Zportals < 6.3.4 - Subscriber+ Arbitrary File Upload | |
| CVE-2026-15210 | Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeov | |
| CVE-2026-15230 | YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclo | |
| CVE-2026-15372 | WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider | |
| CVE-2026-15360 | Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args | |
| CVE-2026-16940 | Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path T | |
| CVE-2026-16981 | DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR | |
| CVE-2026-16993 | DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Up | |
| CVE-2026-16561 | Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure | |
| CVE-2026-16942 | WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS | |
| CVE-2026-16603 | Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure | |
| CVE-2026-16736 | User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registrati | |
| CVE-2026-16613 | GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF | |
| CVE-2026-16604 | Content Protector (Passster) < 4.3.6 - Unauthenticated Protected Content Disclosure via Co | |
| CVE-2026-16746 | MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commission | |
| CVE-2026-16605 | MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Contest Gallery
- CVE-2026-61986
WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scri - CVE-2026-16056
Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History - CVE-2026-16057
Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion v - CVE-2026-65447
WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scri - CVE-2026-57662
WordPress Contest Gallery plugin <= 30.0.0 - SQL Injection v
Same vendor: Unknown
- CVE-2026-75860
JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Up - CVE-2026-74992
Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload - CVE-2026-19699
GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience D - CVE-2026-19615
Admin and Site Enhancements < 9.0.1 - Author+ Stored XSS via - CVE-2026-19697
GutenKit < 2.5.0 - Author+ Stored XSS via SVG Upload
V. Comments for CVE-2026-16055
No comments yet