CVE-2026-12165: Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 30.0.2 via the RegistryUserRole parameter. This is due to the plugin's admin menu being registered at the editposts capability level — granting Contributor-level users access to the plugin's admin pages and a valid cgadmin nonce — while the option-saving handler in change-options-and-sizes.php performs no currentusercan() capability check beyond checkadminreferer('cgadmin'), and the RegistryUserRole value is processed only through sanitizetextfield() and htmlentities() without restriction to an allowlist of permitted role names. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the plugin's stored RegistryUserRole option with administrator, which the cgcreatewpuserfromgoogleuser function then reads back from the contestgal1eryregistryandloginoptions database table without any allowlist validation and passes directly to wpupdateuser(), effectively promoting a newly registered Google sign-in account to Administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe (WordPress plugin)from your environment.Uninstall the plugin if it is not required or until a secure update addressing the RegistryUserRole and capability-check issues is available.
- Configuration
Register the plugin admin menu with an administrator-level capability (do not register it at the 'edit_posts' capability) so Contributor/Author users cannot access the plugin admin pages.
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe (WordPress plugin) admin_menu_capability = require administrator-level capability instead of edit_posts - Configuration
Add a proper current_user_can() capability check in the option-saving handler (in addition to check_admin_referer('cg_admin')) to ensure only authorized users can update plugin options.
Contest Gallery plugin (change-options-and-sizes.php) option_save_capability_check = require current_user_can() for an appropriate administrator capability in addition to check_admin_referer('cg_admin') - Configuration
Restrict the RegistryUserRole value to an explicit allowlist of permitted role names and validate/verify the value before saving to options and before passing it to wp_update_user(). Do not rely solely on sanitize_text_field() or htmlentities().
Contest Gallery plugin RegistryUserRole validation = validate against an allowlist of permitted role names before saving or using the value - Compensating control
Disable or temporarily restrict Google sign-in / automatic user-creation functionality provided by the plugin until the plugin has been updated to properly validate RegistryUserRole and check capabilities.
- Operational
Audit existing user accounts (especially accounts created via Google sign-in) for unauthorized administrator privileges; demote or remove any illegitimate administrator accounts and rotate credentials/secrets as appropriate.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12165?
The severity of CVE-2026-12165 is rated as high, with a score of 8.8.
How do I fix CVE-2026-12165?
To fix CVE-2026-12165, update the Contest Gallery plugin to version 30.0.3 or later.
What type of vulnerability is CVE-2026-12165?
CVE-2026-12165 is a privilege escalation vulnerability affecting the Contest Gallery WordPress plugin.
Who is affected by CVE-2026-12165?
Authenticated users with Author+ privileges on sites using the Contest Gallery plugin up to version 30.0.2 are affected by CVE-2026-12165.
What does the RegistryUserRole parameter do in CVE-2026-12165?
The RegistryUserRole parameter in CVE-2026-12165 allows for unauthorized privilege escalation, enabling attackers to gain higher access.