CVE-2026-16055: Contest Gallery Authentication Bypass Flaw

CVE-2026-16055 Overview

CVE-2026-16055 is an authentication weakness [CWE-287] in the Contest Gallery WordPress plugin versions prior to 30.0.7. The plugin implements its own front-end login flow instead of routing authentication through the standard WordPress pipeline. After a successful password check, it issues an authentication cookie directly, sidestepping installed brute-force protection and two-factor authentication (2FA) controls. Attackers can perform unlimited, unthrottled password guessing against any account, including administrators, leading to full account takeover.

Critical Impact
Attackers can bypass brute-force throttling and 2FA to take over WordPress administrator accounts through unlimited password guessing.

Affected Products

Contest Gallery WordPress plugin versions prior to 30.0.7
WordPress sites relying on third-party brute-force protection plugins
WordPress sites relying on third-party 2FA plugins for login hardening

Discovery Timeline

2026-08-05 - CVE-2026-16055 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-16055

Vulnerability Analysis

The Contest Gallery plugin exposes a front-end login handler that authenticates users outside the WordPress core authentication flow. WordPress security plugins hook into filters and actions such as authenticate, wp_login_failed, and wp_login to enforce rate limiting, IP lockouts, and 2FA challenges. Because the plugin verifies credentials and issues the auth cookie without invoking these hooks, none of the layered defenses execute.

An attacker only needs a valid username to iterate through candidate passwords at high volume. There is no lockout after repeated failures, no CAPTCHA challenge, and no second-factor prompt when the password is finally guessed. Success yields an authenticated session cookie identical to a legitimate login, granting the attacker the victim account's role and privileges.

Root Cause

The root cause is an improper authentication implementation [CWE-287]. The plugin performs its own password comparison and calls the cookie-setting routine directly rather than delegating to wp_signon() and the standard authenticate filter chain. This design decision removes the extension points that security plugins depend on to enforce brute-force protection and multi-factor authentication.

Attack Vector

Exploitation occurs over the network against the plugin's front-end login endpoint. The attacker requires a known or guessable username and issues repeated authentication requests with varying passwords. Because no throttling is applied, standard credential-stuffing and dictionary attacks succeed at machine speed. Once the correct password is submitted, the response contains a valid WordPress authentication cookie, and no 2FA challenge is presented. See the WPScan Vulnerability Report for the technical writeup.

Detection Methods for CVE-2026-16055

Indicators of Compromise

High volumes of POST requests to Contest Gallery front-end login endpoints from a single source IP or distributed botnet
Successful WordPress session cookies issued without corresponding entries in 2FA plugin logs
Administrator logins that do not appear in the standard wp-login.php access logs
New administrator accounts, plugin installations, or theme edits following anomalous login traffic

Detection Strategies

Correlate web server access logs for repeated requests to plugin login handlers with response codes indicating authentication attempts
Alert on WordPress wp_login events that lack matching 2FA verification events from the installed MFA plugin
Baseline the ratio of failed to successful logins per account and flag deviations consistent with brute forcing

Monitoring Recommendations

Enable verbose access logging on the WordPress front controller and archive logs to a centralized platform for retention
Monitor for creation of administrator users, changes to wp_users and wp_usermeta, and modifications to plugin or theme files
Track outbound connections from the web server that could indicate post-compromise webshell or reverse-shell activity

How to Mitigate CVE-2026-16055

Immediate Actions Required

Update the Contest Gallery plugin to version 30.0.7 or later on all WordPress sites
Force a password reset for all WordPress user accounts, prioritizing administrators and editors
Audit the user table for unauthorized accounts and remove any that cannot be attributed to a known administrator
Review recent plugin, theme, and file changes for signs of post-authentication compromise

Patch Information

The vendor addressed the issue in Contest Gallery version 30.0.7 by routing front-end authentication through the standard WordPress flow. Details are available in the WPScan Vulnerability Report.

Workarounds

Disable and remove the Contest Gallery plugin until the site can be upgraded to version 30.0.7 or later
Restrict access to the plugin's front-end login endpoint at the web server or WAF layer
Enforce strong, unique passwords and rotate credentials for privileged WordPress accounts

bash

# Example WAF rule: rate-limit requests to the plugin's login endpoint
# Adjust the location match to your Contest Gallery install path
limit_req_zone $binary_remote_addr zone=cglogin:10m rate=5r/m;

location ~* /wp-content/plugins/contest-gallery/.*login {
    limit_req zone=cglogin burst=5 nodelay;
    deny all;
}