CVE-2026-16056: broken auth leaks OpenAI prompts

CISO Take

The Contest Gallery WordPress plugin (before 30.0.7) exposes an AJAX handler that skips capability and nonce checks, letting any authenticated user — even the lowest-privileged Subscriber role — pull the site's entire stored OpenAI prompt history. This isn't exotic AI attack tradecraft; it's a textbook broken access control (CWE-862) bug that happens to sit in front of an LLM integration, so the blast radius is whatever the plugin has been feeding into and receiving from OpenAI: contest judging logic, business prompts, and potentially user-submitted content processed by the model. A public PoC already exists and CISA SSVC has it tagged TRACK, though it's not in KEV and EPSS puts real-world exploitation probability at a modest 0.16% despite ranking in the top 94th percentile among scored CVEs — low absolute likelihood, but trivial to weaponize if a site has open subscriber registration (common on contest/gallery sites). Patch to Contest Gallery 30.0.7 or later immediately; in the interim, disable open user self-registration or restrict it to trusted roles, and audit logs for subscriber-level accounts hitting the plugin's admin-ajax.php actions. Treat any exposed prompt history as compromised — rotate the OpenAI API key and review whether prompts or responses contained sensitive business logic or user PII.

Sources: NVD EPSS ATLAS OWASP LLM Top 10 wpscan.com

What is the risk?

CVSS 4.3 (medium) reflects a confidentiality-only impact with no integrity or availability loss, but the practical risk is elevated by the near-zero exploitation bar: PR:L means only a Subscriber-level account is needed (often self-registerable on public sites), AC:L, UI:N, and a public PoC is already circulating. The ceiling on severity is that this leaks stored prompt data rather than granting code execution or account takeover, but for any organization using this plugin's OpenAI integration to process business-sensitive or customer content, that data itself can be the crown jewels. No CISA KEV listing and low absolute EPSS (0.16%) suggest opportunistic rather than targeted mass exploitation is the primary threat model for now.

How does the attack unfold?

Initial Access

Attacker registers a Subscriber-level WordPress account, often via open self-registration common on contest/gallery sites.

AML.T0012

Exploitation

Attacker directly invokes the vulnerable Contest Gallery AJAX handler, which lacks capability and nonce checks, using the publicly available PoC.

Collection

The handler returns the site's entire stored OpenAI prompt history without verifying the requester's authorization level.

AML.T0036

Impact

Attacker exfiltrates and mines the prompt history for business logic, system prompts, or user-submitted content processed by the AI feature.

AML.T0025

Initial Access

Attacker registers a Subscriber-level WordPress account, often via open self-registration common on contest/gallery sites.

AML.T0012

Exploitation

Attacker directly invokes the vulnerable Contest Gallery AJAX handler, which lacks capability and nonce checks, using the publicly available PoC.

Collection

The handler returns the site's entire stored OpenAI prompt history without verifying the requester's authorization level.

AML.T0036

Impact

Attacker exfiltrates and mines the prompt history for business logic, system prompts, or user-submitted content processed by the AI feature.

AML.T0025

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I None

A None

What should I do?

1 step

1) Upgrade Contest Gallery to 30.0.7 or later immediately — this is a direct vendor fix, not a config workaround. 2) Until patched, disable open user self-registration on the site or require admin approval for new Subscriber accounts to remove the low-friction attack path. 3) Review WordPress access/audit logs for admin-ajax.php requests originating from Subscriber-role accounts targeting Contest Gallery actions. 4) Treat the OpenAI API key used by the plugin as potentially exposed — rotate it and review OpenAI usage logs for anomalous activity. 5) Audit the retained prompt history for sensitive business logic or user PII and purge/redact as needed per data retention policy.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Plugin API AML.T0012 - Valid Accounts AML.T0025 - Exfiltration via Cyber Means AML.T0036 - Data from Information Repositories

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.7.4 - Data for AI systems

NIST AI RMF

MANAGE-1.1 - AI system risks and benefits are managed based on assessed impacts

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-16056?

The Contest Gallery WordPress plugin (before 30.0.7) exposes an AJAX handler that skips capability and nonce checks, letting any authenticated user — even the lowest-privileged Subscriber role — pull the site's entire stored OpenAI prompt history. This isn't exotic AI attack tradecraft; it's a textbook broken access control (CWE-862) bug that happens to sit in front of an LLM integration, so the blast radius is whatever the plugin has been feeding into and receiving from OpenAI: contest judging logic, business prompts, and potentially user-submitted content processed by the model. A public PoC already exists and CISA SSVC has it tagged TRACK, though it's not in KEV and EPSS puts real-world exploitation probability at a modest 0.16% despite ranking in the top 94th percentile among scored CVEs — low absolute likelihood, but trivial to weaponize if a site has open subscriber registration (common on contest/gallery sites). Patch to Contest Gallery 30.0.7 or later immediately; in the interim, disable open user self-registration or restrict it to trusted roles, and audit logs for subscriber-level accounts hitting the plugin's admin-ajax.php actions. Treat any exposed prompt history as compromised — rotate the OpenAI API key and review whether prompts or responses contained sensitive business logic or user PII.

Is CVE-2026-16056 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-16056, increasing the risk of exploitation.

How to fix CVE-2026-16056?

1) Upgrade Contest Gallery to 30.0.7 or later immediately — this is a direct vendor fix, not a config workaround. 2) Until patched, disable open user self-registration on the site or require admin approval for new Subscriber accounts to remove the low-friction attack path. 3) Review WordPress access/audit logs for admin-ajax.php requests originating from Subscriber-role accounts targeting Contest Gallery actions. 4) Treat the OpenAI API key used by the plugin as potentially exposed — rotate it and review OpenAI usage logs for anomalous activity. 5) Audit the retained prompt history for sensitive business logic or user PII and purge/redact as needed per data retention policy.

What systems are affected by CVE-2026-16056?

This vulnerability affects the following AI/ML architecture patterns: LLM API integrations, CMS/plugin-embedded AI features.

What is the CVSS score for CVE-2026-16056?

CVE-2026-16056 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.16%.

What is the AI security impact?

Affected AI Architectures

LLM API integrationsCMS/plugin-embedded AI features

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0025 Exfiltration via Cyber Means

AML.T0036 Data from Information Repositories

Compliance Controls Affected

ISO 42001: A.7.4

NIST AI RMF: MANAGE-1.1

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.

Exploitation Scenario

An attacker registers a free Subscriber account on a WordPress site running a vulnerable Contest Gallery install (many contest/gallery sites allow open registration for entrants). Using the publicly available PoC, the attacker sends a direct request to the plugin's vulnerable AJAX handler — no nonce or capability check blocks the request despite the attacker holding only the lowest WordPress role. The handler returns the site's full stored OpenAI prompt history, which the attacker can mine for the plugin's system prompts, business logic embedded in the prompts, or content submitted by other users that was routed through the AI feature — turning a low-privilege account into a data exfiltration foothold with zero user interaction from anyone else.

Weaknesses (CWE)

CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.