CVE-2026-12165: Contest Gallery WordPress Plugin Privilege Escalation to Administrator

Technical summary

The vulnerability chains two failures in the Contest Gallery plugin. First, the admin menu registration uses `edit_posts` capability, permitting Contributor access. Second, the `change-options-and-sizes.php` handler saving the `RegistryUserRole` option relies solely on nonce validation (`check_admin_referer('cg_admin')`) without calling `current_user_can()` for capability enforcement. The `RegistryUserRole` value is sanitized via `sanitize_text_field()` and `htmlentities()` but not restricted to an allowlist of valid roles. When `cg_create_wp_user_from_google_user` reads this option from the database, it passes the unsanitized role directly to `wp_update_user()` without validation, enabling role promotion to Administrator.

Business impact

An authenticated contributor account — commonly held by freelancers, guest authors, or external partners — becomes a vehicle for obtaining full administrative control of a WordPress site. Once an attacker has Administrator access, they can install malicious plugins, alter site content, exfiltrate data, inject backdoors, or shut down the site entirely. Organizations relying on the Contest Gallery plugin for photo contests, user engagement, or community features face exposure to complete account takeover and operational compromise.

Affected systems

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is affected in all versions up to and including 30.0.2. Any WordPress installation running this plugin version is at risk if it permits Google sign-in registration and has contributors or higher-level users with access to admin pages.

Exploitability

Exploitation requires an authenticated attacker with at least Contributor-level WordPress access. No additional interaction, user interaction, or complex conditions are needed; the attacker directly modifies the plugin setting and waits for a new Google sign-in registration to be processed with the malicious role. The attack is over the network with low attack complexity, making it straightforward to execute.

Remediation

Update the Contest Gallery plugin to a patched version released after 30.0.2. Verify the availability of security updates from the plugin vendor. As an interim measure, restrict Contributor-level user accounts, audit existing admin access logs for suspicious role changes, and review user accounts created via Google sign-in for unexpected Administrator privileges.

Patch guidance

Check the plugin vendor's repository or security advisory page for version 30.0.3 or later. Apply the update through the WordPress plugin dashboard or manually upload the patched version. Verify the update has completed successfully and test Google sign-in functionality with a non-admin test account to confirm normal behavior is restored.

Detection guidance

Monitor the `wp_options` table for unexpected changes to the `contest_gal1ery_registry_and_login_options` entry, particularly modifications to `RegistryUserRole`. Audit user creation logs for Google sign-in accounts assigned Administrator role. Check admin audit logs for activity from Contributor-level users accessing the Contest Gallery admin pages followed by option modifications. Review user role escalations post-publication of this advisory.

Why prioritize this

This is a HIGH-severity privilege escalation requiring only authenticated access at the Contributor level — a role commonly delegated to external or temporary users. The impact is complete administrative compromise. Organizations should prioritize patching after assessing whether they use this plugin and how many users have Contributor access.

Risk score, explained

CVSS 3.1 score of 8.8 (HIGH) reflects network-accessible attack vector, low complexity, low privilege requirements (Contributor), no user interaction needed, and high impact across confidentiality, integrity, and availability. The vulnerability is straightforward to exploit and yields complete system control.

Frequently asked questions