CVE-2026-16057

The CVE affects the Contest Gallery WordPress plugin prior to version 30.0.7. One post-deletion handler omits per-object capability checks and nonce validation, gating the action only by a coarse role-membership test. This allows any user with Author-level or higher privileges to permanently dele...