Contest Gallery exposes the complete OpenAI prompt history to Subscribers
Contest Gallery before 30.0.7 omits both capability and nonce checks from a handler that returns the site's stored OpenAI prompt history. Any authenticated user, including a Subscriber, can invoke it and read every retained prompt, which may contain private instructions or submitted content. The public advisory does not disclose the handler route, action, callback or response schema.
- Component
- Contest Gallery
- Plugin slug
contest-gallery- Affected
- < 30.0.7
- Safe version
30.0.7- Published
- Aug 04, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Aug 04, 2026 and is one of 60 known issues for this plugin.
Update, patch or deactivate.
Update Contest Gallery to 30.0.7 or later. Review low-privilege access to the affected handler and treat secrets or private content included in stored prompts as potentially disclosed.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N