Junglewise Threat Intelligence

CVE-2026-12165: Contest Gallery WordPress plugin privilege escalation

CVE-2026-12165 · Severity: high · CVSS 8.8 · Published 2026-06-17

Technologies: Contest Gallery. Vendors: Contest Gallery.

Executive brief

The Contest Gallery plugin for WordPress, which manages photo contests and media sales, contains a security flaw that allows low-level users to gain full administrative control of a website. By exploiting a weakness in how the plugin saves user registration settings, an attacker with basic account access can force the system to grant administrator privileges to new accounts. This could lead to a total takeover of the website, including the ability to steal data, modify content, or lock out legitimate owners.

Technical details

The Contest Gallery plugin for WordPress is vulnerable to privilege escalation due to improper capability checks and lack of input validation on the 'RegistryUserRole' parameter. The plugin's admin menu is registered with the 'edit_posts' capability, allowing Contributor-level users to access admin pages and obtain a valid 'cg_admin' nonce. The option-saving handler in 'change-options-and-sizes.php' fails to perform a 'current_user_can()' check, allowing an authenticated attacker (Author-level or above) to overwrite the default registration role with 'administrator'. Subsequently, the 'cg_create_wp_user_from_google_user' function reads this value and applies it via 'wp_update_user()' during Google sign-in registration, effectively promoting new accounts to the Administrator role. The vulnerability is fixed in versions following 30.0.2.

Affected products

  • contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe up to, and including, 30.0.2

Timeline

  • 2026-06-17: disclosed
  • 2026-06-17: advisory

References

Related threats