{"data":{"id":"bbf77c5d-3a5e-46d1-90ca-66ba6f37aa5a","title":"CVE-2026-16056: The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handler…","summary":"CVE-2026-16056 affects the Contest Gallery WordPress plugin before 30.0.7. One of its handlers performs no capability or nonce check, so any authenticated user, down to the Subscriber role, can read the site's entire stored OpenAI prompt history. NVD has not yet provided an assessment, and the source is WPScan.","solution":"N/A -- no mitigation discussed in source.","labels":["security","privacy"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16056","publishedAt":"2026-08-04T07:16:29.477Z","cveId":"CVE-2026-16056","cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI"],"affectedVendorsRaw":["OpenAI prompt history","Contest Gallery WordPress plugin"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Contest Gallery WordPress plugin exposes OpenAI prompt history","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0027,"epssCheckedAt":"2026-11-04T18:09:12.821Z","kevDateAdded":null,"advisoryAliases":["GHSA-xp5w-q4v3-mxrm"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-02T06:10:36.451Z","patchAvailable":null,"disclosureDate":"2026-08-04T07:16:29.477Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[]}}