CyberRota Analysis
AI-GeneratedThe Contest Gallery plugin for WordPress versions prior to 30.0.7 is vulnerable due to inadequate access controls in its post-deletion handlers, allowing any user with Author-level permissions or higher to delete any content, including posts and pages, regardless of ownership. This flaw poses a significant risk of content loss and potential disruption for affected sites. WordPress administrators, particularly those using this plugin, should prioritize updating to the latest version to mitigate this vulnerability.
Original NVD Description
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.