Contest Gallery CVE-2026-12165

Requires an authenticated WordPress account at Contributor level or above on the target site (per CVSS PR:L and the description's 'author-level access and above'), the Contest Gallery plugin installed and active at version ≤ 30.0.2, and - to realize the Administrator promotion - the plugin's Google sign-in / registration feature must be enabled so that cg_create_wp_user_from_google_user() actually consumes the poisoned RegistryUserRole option when a new Google account registers. No user interaction by an admin is needed (UI:N) and the attack is performed over the network against the wp-admin interface; sites without Google sign-in still get the option overwritten but cannot be escalated through this specific code path.

CVSS 3.1 base of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact achievable by a low-privileged authenticated attacker with no user interaction - consistent with the description, which requires only Contributor/Author access. There is no CISA KEV listing and no EPSS score provided, and no public exploit identified at time of analysis, so this should be treated as a high-severity but not yet actively exploited issue. The realistic risk is elevated for multi-author WordPress sites that allow self-registration at Contributor/Author tier or where attackers can obtain such accounts, since promotion to Administrator yields full site takeover via the Google sign-in flow; sites without Google sign-in enabled still have the option overwritten but only suffer impact once a Google account registers.

An attacker registers or compromises a Contributor- or Author-level account on a target WordPress site running Contest Gallery ≤ 30.0.2, browses to the plugin's admin page to obtain a valid cg_admin nonce, then submits a crafted POST to change-options-and-sizes.php setting RegistryUserRole=administrator. The attacker then completes a Google sign-in registration on the site; cg_create_wp_user_from_google_user() reads the poisoned option and calls wp_update_user() to make the new Google-linked account an Administrator, granting full site takeover. No public exploit identified at time of analysis.