What is the CVSS score of EUVD-2026-37586?

EUVD-2026-37586 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

How to fix or mitigate EUVD-2026-37586?

Within 24 hours: Audit all WordPress installations running Contest Gallery plugin versions ≤30.0.2 with Google sign-in enabled. Within 7 days: Implement compensating controls (disable Google sign-in integration, restrict Contributor/Author roles to trusted personnel only, review admin account creation logs). Within 30 days: Monitor for vendor patch release; plan plugin replacement or site migration if patch remains unavailable.

Contest Gallery EUVD-2026-37586

| CVE-2026-12165 HIGH

Improper Privilege Management (CWE-269)

2026-06-17 Wordfence

PHP WordPress Privilege Escalation Google Contest Gallery Upload Vote Photos Media Sell With Paypal Stripe Contest Gallery Wordpress Plugin

8.8

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Obtain Contributor/Author account
Delivery

Load plugin admin page for cg_admin nonce
Exploit

POST RegistryUserRole=administrator to change-options-and-sizes.php
Install

Trigger Google sign-in registration
C2

cg_create_wp_user_from_google_user calls wp_update_user
Execute

New account promoted to Administrator
Impact

Full WordPress site takeover

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires an authenticated WordPress account at Contributor level or above on the target site (per CVSS PR:L and the description's 'author-level access and above'), the Contest Gallery plugin installed and active at version ≤ 30.0.2, and - to realize the Administrator promotion - the plugin's Google sign-in / registration feature must be enabled so that cg_create_wp_user_from_google_user() actually consumes the poisoned RegistryUserRole option when a new Google account registers. No user interaction by an admin is needed (UI:N) and the attack is performed over the network against the wp-admin interface; sites without Google sign-in still get the option overwritten but cannot be escalated through this specific code path.
Impact	CVSS 3.1 base of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact achievable by a low-privileged authenticated attacker with no user interaction - consistent with the description, which requires only Contributor/Author access. There is no CISA KEV listing and no EPSS score provided, and no public exploit identified at time of analysis, so this should be treated as a high-severity but not yet actively exploited issue. The realistic risk is elevated for multi-author WordPress sites that allow self-registration at Contributor/Author tier or where attackers can obtain such accounts, since promotion to Administrator yields full site takeover via the Google sign-in flow; sites without Google sign-in enabled still have the option overwritten but only suffer impact once a Google account registers.
Exploit ScenarioDerived	An attacker registers or compromises a Contributor- or Author-level account on a target WordPress site running Contest Gallery ≤ 30.0.2, browses to the plugin's admin page to obtain a valid cg_admin nonce, then submits a crafted POST to change-options-and-sizes.php setting RegistryUserRole=administrator. The attacker then completes a Google sign-in registration on the site; cg_create_wp_user_from_google_user() reads the poisoned option and calls wp_update_user() to make the new Google-linked account an Administrator, granting full site takeover. No public exploit identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 17, 2026

Privilege escalation in the Contest Gallery WordPress plugin (versions ≤ 30.0.2) allows authenticated Contributor/Author-level users to overwrite the stored RegistryUserRole option to 'administrator', causing newly registered Google sign-in accounts to be promoted to Administrator. The flaw was disclosed by Wordfence and stems from a missing capability check in the option-saving handler; no public exploit identified at time of analysis.

RemediationAI

Upstream fix available (commit/changeset 3571733 in the contest-gallery plugin repository); released patched version not independently confirmed from the supplied references - administrators should update to the next plugin release above 30.0.2 once published on wordpress.org and verify via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/69b909da-b1b0-4dab-916c-908511f6556f. Until a tagged release is available, restrict Contributor/Author accounts to trusted users, disable open user registration or lower the default new-user role to Subscriber, and disable the plugin's Google sign-in registration feature so that a tampered RegistryUserRole cannot be consumed by cg_create_wp_user_from_google_user() - the trade-off is loss of Google login UX. Optionally block access to the plugin's admin pages under v10/v10-admin/options/ via a WAF rule or web-server ACL for non-Administrator users, accepting that this may interfere with legitimate plugin administration.

Affected VersionsENISA

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe 0 ≤30.0.2

Affected Packages

euvd contest_gallery_upload_vote_photos_media_sell_with_paypal_stripe no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerable component is a WordPress plugin (CPE: contest-gallery:contest_gallery_-_upload_&_vote_photos,_media,_sell_with_paypal_&_stripe) written in PHP that integrates Google sign-in for user registration. The root cause is CWE-269 (Improper Privilege Management): the admin menu is registered at the edit_posts capability - granting Contributor+ users a valid cg_admin nonce - while the handler in v10/v10-admin/options/change-options-and-sizes.php gates writes solely on check_admin_referer('cg_admin') with no current_user_can() check. The RegistryUserRole input is filtered only through sanitize_text_field() and htmlentities(), not constrained to an allowlist of WordPress roles, and is later read back from the contest_gal1ery_registry_and_login_options table and passed directly into wp_update_user() by cg_create_wp_user_from_google_user().

Know when Contest Gallery gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Network-reachable wp-admin endpoint, low-complexity option overwrite by a Contributor/Author (PR:L), no admin interaction, and Administrator promotion yields full C/I/A impact within the WordPress scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

The Contest Gallery - Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 30.0.2 via the RegistryUserRole parameter. This is due to the plugin's admin menu being registered at the edit_posts capability level - granting Contributor-level users access to the plugin's admin pages and a valid cg_admin nonce - while the option-saving handler in change-options-and-sizes.php performs no current_user_can() capability check beyond check_admin_referer('cg_admin'), and the RegistryUserRole value is processed only through sanitize_text_field() and htmlentities() without restriction to an allowlist of permitted role names. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the plugin's stored RegistryUserRole option with administrator, which the cg_create_wp_user_from_google_user function then reads back from the contest_gal1ery_registry_and_login_options database table without any allowlist validation and passes directly to wp_update_user(), effectively promoting a newly registered Google sign-in account to Administrator.

Executive ViewAI

Why It Matters

The Contest Gallery WordPress plugin (versions 30.0.2 and earlier) contains a privilege escalation vulnerability allowing authenticated Contributor and Author users to grant themselves Administrator access; no public exploit identified at time of analysis. Risk is concentrated among organizations using this plugin with Google sign-in enabled, where successful exploitation could enable unauthorized administrative access and compromise system and data controls.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Temporarily deactivate Contest Gallery plugin or disable Google sign-in functionality; (2) Restrict Contributor and Author roles to trusted personnel only; (3) Implement audit logging and alerting for new administrator account creation; (4) Conduct forensic review of admin accounts created since plugin deployment to identify potential exploitation.

Threat Intelligence Overview

EPSS Score

0.6%

Top 58% exploitable

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.6%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.