What is the CVSS score of CVE-2026-12165?

CVE-2026-12165 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Contest Gallery are affected by CVE-2026-12165?

The Contest Gallery WordPress plugin (versions 30.0.2 and earlier) contains a privilege escalation vulnerability allowing authenticated Contributor and Author users to grant themselves Administrator…

How to fix or mitigate CVE-2026-12165?

Within 24 hours: Audit all WordPress installations running Contest Gallery plugin versions ≤30.0.2 with Google sign-in enabled. Within 7 days: Implement compensating controls (disable Google sign-in integration, restrict Contributor/Author roles to trusted personnel only, review admin account creation logs). Within 30 days: Monitor for vendor patch release; plan plugin replacement or site migration if patch remains unavailable.

Contest Gallery CVE-2026-12165

EUVD-2026-37586 HIGH

Improper Privilege Management (CWE-269)

2026-06-17 Wordfence

Privilege Escalation PHP Google WordPress Contest Gallery Upload Vote Photos Media Sell With Paypal Stripe

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable wp-admin endpoint, low-complexity option overwrite by a Contributor/Author (PR:L), no admin interaction, and Administrator promotion yields full C/I/A impact within the WordPress scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 10:16 vuln.today

CVE Published

Jun 17, 2026 - 09:30 cve.org

HIGH 8.8

DescriptionCVE.org

The Contest Gallery - Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 30.0.2 via the RegistryUserRole parameter. This is due to the plugin's admin menu being registered at the edit_posts capability level - granting Contributor-level users access to the plugin's admin pages and a valid cg_admin nonce - while the option-saving handler in change-options-and-sizes.php performs no current_user_can() capability check beyond check_admin_referer('cg_admin'), and the RegistryUserRole value is processed only through sanitize_text_field() and htmlentities() without restriction to an allowlist of permitted role names. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the plugin's stored RegistryUserRole option with administrator, which the cg_create_wp_user_from_google_user function then reads back from the contest_gal1ery_registry_and_login_options database table without any allowlist validation and passes directly to wp_update_user(), effectively promoting a newly registered Google sign-in account to Administrator.

AnalysisAI

Privilege escalation in the Contest Gallery WordPress plugin (versions ≤ 30.0.2) allows authenticated Contributor/Author-level users to overwrite the stored RegistryUserRole option to 'administrator', causing newly registered Google sign-in accounts to be promoted to Administrator. The flaw was disclosed by Wordfence and stems from a missing capability check in the option-saving handler; no public exploit identified at time of analysis.

Technical ContextAI

The vulnerable component is a WordPress plugin (CPE: contest-gallery:contest_gallery_-_upload_&_vote_photos,_media,_sell_with_paypal_&_stripe) written in PHP that integrates Google sign-in for user registration. The root cause is CWE-269 (Improper Privilege Management): the admin menu is registered at the edit_posts capability - granting Contributor+ users a valid cg_admin nonce - while the handler in v10/v10-admin/options/change-options-and-sizes.php gates writes solely on check_admin_referer('cg_admin') with no current_user_can() check. The RegistryUserRole input is filtered only through sanitize_text_field() and htmlentities(), not constrained to an allowlist of WordPress roles, and is later read back from the contest_gal1ery_registry_and_login_options table and passed directly into wp_update_user() by cg_create_wp_user_from_google_user().

RemediationAI

Upstream fix available (commit/changeset 3571733 in the contest-gallery plugin repository); released patched version not independently confirmed from the supplied references - administrators should update to the next plugin release above 30.0.2 once published on wordpress.org and verify via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/69b909da-b1b0-4dab-916c-908511f6556f. Until a tagged release is available, restrict Contributor/Author accounts to trusted users, disable open user registration or lower the default new-user role to Subscriber, and disable the plugin's Google sign-in registration feature so that a tampered RegistryUserRole cannot be consumed by cg_create_wp_user_from_google_user() - the trade-off is loss of Google login UX. Optionally block access to the plugin's admin pages under v10/v10-admin/options/ via a WAF rule or web-server ACL for non-Administrator users, accepting that this may interfere with legitimate plugin administration.