EUVD-2026-37586Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable wp-admin endpoint, low-complexity option overwrite by a Contributor/Author (PR:L), no admin interaction, and Administrator promotion yields full C/I/A impact within the WordPress scope.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Contest Gallery - Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 30.0.2 via the RegistryUserRole parameter. This is due to the plugin's admin menu being registered at the edit_posts capability level - granting Contributor-level users access to the plugin's admin pages and a valid cg_admin nonce - while the option-saving handler in change-options-and-sizes.php performs no current_user_can() capability check beyond check_admin_referer('cg_admin'), and the RegistryUserRole value is processed only through sanitize_text_field() and htmlentities() without restriction to an allowlist of permitted role names. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the plugin's stored RegistryUserRole option with administrator, which the cg_create_wp_user_from_google_user function then reads back from the contest_gal1ery_registry_and_login_options database table without any allowlist validation and passes directly to wp_update_user(), effectively promoting a newly registered Google sign-in account to Administrator.
AnalysisAI
Privilege escalation in the Contest Gallery WordPress plugin (versions ≤ 30.0.2) allows authenticated Contributor/Author-level users to overwrite the stored RegistryUserRole option to 'administrator', causing newly registered Google sign-in accounts to be promoted to Administrator. The flaw was disclosed by Wordfence and stems from a missing capability check in the option-saving handler; no public exploit identified at time of analysis.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account at Contributor level or above on the target site (per CVSS PR:L and the description's 'author-level access and above'), the Contest Gallery plugin installed and active at version ≤ 30.0.2, and - to realize the Administrator promotion - the plugin's Google sign-in / registration feature must be enabled so that cg_create_wp_user_from_google_user() actually consumes the poisoned RegistryUserRole option when a new Google account registers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 base of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact achievable by a low-privileged authenticated attacker with no user interaction - consistent with the description, which requires only Contributor/Author access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a Contributor- or Author-level account on a target WordPress site running Contest Gallery ≤ 30.0.2, browses to the plugin's admin page to obtain a valid cg_admin nonce, then submits a crafted POST to change-options-and-sizes.php setting RegistryUserRole=administrator. The attacker then completes a Google sign-in registration on the site; cg_create_wp_user_from_google_user() reads the poisoned option and calls wp_update_user() to make the new Google-linked account an Administrator, granting full site takeover. … |
| Remediation | Upstream fix available (commit/changeset 3571733 in the contest-gallery plugin repository); released patched version not independently confirmed from the supplied references - administrators should update to the next plugin release above 30.0.2 once published on wordpress.org and verify via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/69b909da-b1b0-4dab-916c-908511f6556f. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress installations running Contest Gallery plugin versions ≤30.0.2 with Google sign-in enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today