# CVE-2026-12165: Contest Gallery WordPress plugin privilege escalation

Source: https://junglewise.ai/threats/cve-2026-12165-contest-gallery-wordpress-plugin-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-17  
License: CC BY 4.0 with a link back

CVE-2026-12165 · Severity: high · CVSS 8.8 · Published 2026-06-17

The Contest Gallery plugin for WordPress, which manages photo contests and media sales, contains a security flaw that allows low-level users to gain full administrative control of a website. By exploiting a weakness in how the plugin saves user registration settings, an attacker with basic account access can force the system to grant administrator privileges to new accounts. This could lead to a total takeover of the website, including the ability to steal data, modify content, or lock out legitimate owners.

Technologies: [Contest Gallery](https://junglewise.ai/threats/technologies/contest-gallery). Vendors: [Contest Gallery](https://junglewise.ai/threats/vendors/contest-gallery).

## Quick answers

**Is CVE-2026-12165 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12165 being exploited in the wild.

**How severe is CVE-2026-12165?** High severity, with a CVSS score of 8.8, published 17 June 2026.

**Which products and versions are affected?** Contest Gallery up to, and including, 30.0.2.

**Is there a fix for CVE-2026-12165?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12165 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12165?** Check whether you run Contest Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Contest Gallery plugin for WordPress is vulnerable to privilege escalation due to improper capability checks and lack of input validation on the 'RegistryUserRole' parameter. The plugin's admin menu is registered with the 'edit_posts' capability, allowing Contributor-level users to access admin pages and obtain a valid 'cg_admin' nonce. The option-saving handler in 'change-options-and-sizes.php' fails to perform a 'current_user_can()' check, allowing an authenticated attacker (Author-level or above) to overwrite the default registration role with 'administrator'. Subsequently, the 'cg_create_wp_user_from_google_user' function reads this value and applies it via 'wp_update_user()' during Google sign-in registration, effectively promoting new accounts to the Administrator role. The vulnerability is fixed in versions following 30.0.2.

## Affected products

- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe up to, and including, 30.0.2

## Timeline

- 2026-06-17: disclosed
- 2026-06-17: advisory

## References

- [https://plugins.trac.wordpress.org/browser/contest-gallery/tags/30.0.2/functions/google/cg-create-wp-user-from-google-user.php](https://plugins.trac.wordpress.org/browser/contest-gallery/tags/30.0.2/functions/google/cg-create-wp-user-from-google-user.php)
- [https://plugins.trac.wordpress.org/browser/contest-gallery/tags/30.0.2/index.php](https://plugins.trac.wordpress.org/browser/contest-gallery/tags/30.0.2/index.php)
- [https://plugins.trac.wordpress.org/browser/contest-gallery/tags/30.0.2/v10/v10-admin/options/change-options-and-sizes.php](https://plugins.trac.wordpress.org/browser/contest-gallery/tags/30.0.2/v10/v10-admin/options/change-options-and-sizes.php)
- [https://plugins.trac.wordpress.org/browser/contest-gallery/tags/30.0.2/v10/v10-admin/options/change-options-and-sizes.php](https://plugins.trac.wordpress.org/browser/contest-gallery/tags/30.0.2/v10/v10-admin/options/change-options-and-sizes.php)
- [https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3571733%40contest-gallery&new=3571733%40contest-gallery&sfp_email=&sfph_mail=](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3571733%40contest-gallery&new=3571733%40contest-gallery&sfp_email=&sfph_mail=)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/69b909da-b1b0-4dab-916c-908511f6556f?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/69b909da-b1b0-4dab-916c-908511f6556f?source=cve)

## Related threats

- [Contest Gallery WordPress plugin vote restriction bypass](https://junglewise.ai/threats/cve-2026-107447-the-contest-gallery-wordpress-plugin-before-34-0-1-does-not)
- [Contest Gallery WordPress plugin missing authorization in OpenAI prompt handler](https://junglewise.ai/threats/cve-2026-16056-contest-gallery-wordpress-plugin-missing-authorization-in-openai)
- [Contest Gallery improper input validation in WordPress plugin](https://junglewise.ai/threats/cve-2026-42657-contest-gallery-improper-input-validation-in-wordpress-plugin)
- [Contest Gallery SQL injection in form_input parameter](https://junglewise.ai/threats/cve-2026-8912-contest-gallery-sql-injection-in-form-input-parameter)