CVE-2026-16055 is an improper authentication vulnerability (CWE-287) in the Contest Gallery WordPress plugin prior to version 30.0.7. The plugin does not use the standard WordPress authentication process for front-end login, instead issuing an authentication cookie immediately after password validation. This bypasses any brute-force protection and two-factor authentication mechanisms installed in WordPress, enabling attackers to guess passwords without throttling or additional security controls. This vulnerability affects all versions before 30.0.7 and can lead to full compromise of user accounts, including administrative accounts.

Attackers can perform unlimited password guessing attacks without triggering brute-force protections or two-factor authentication. This increases the risk of account compromise, including administrative accounts, potentially resulting in full account takeover and complete control over the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the plugin or restricting access to the affected functionality. Monitor for updates from the vendor and apply patches promptly once released.