CVE-2026-12165: 
WordPress vulnerability analysis and mitigation

CVE-2026-12165 is a Privilege Escalation vulnerability in the Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress, affecting all versions up to and including 30.0.2. The flaw allows authenticated attackers with Author-level access or above to escalate their privileges to Administrator by manipulating the RegistryUserRole parameter. It was published on June 17, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Feedly, CVEFeed).

The root cause is Improper Privilege Management (CWE-269). The plugin registers its admin menu at the edit_posts capability level, granting Contributor-level and above users access to admin pages and a valid cg_admin nonce. The option-saving handler in change-options-and-sizes.php performs no current_user_can() capability check beyond check_admin_referer('cg_admin'), and the RegistryUserRole value is only processed through sanitize_text_field() and htmlentities() — with no allowlist validation of permitted role names. When a new Google sign-in account is registered, the cg_create_wp_user_from_google_user function reads the attacker-controlled RegistryUserRole value directly from the contest_gal1ery_registry_and_login_options database table and passes it to wp_update_user(), promoting the new account to Administrator (Feedly, VulnDB).

Successful exploitation grants an attacker full administrative control over the affected WordPress site. An authenticated user with as little as Author-level access can promote a newly registered Google sign-in account to Administrator, enabling complete site takeover — including installing malicious plugins, modifying content, exfiltrating user data, and potentially pivoting to the underlying server. The NVD SSVC assessment rates the technical impact as total, affecting confidentiality, integrity, and availability (Feedly).

1. Gain authenticated access: Obtain an account on the target WordPress site with at least Author-level privileges (sufficient to access the plugin's admin pages via the edit_posts capability).
2. Access the plugin admin page: Navigate to the Contest Gallery admin settings page, which is accessible due to the plugin registering its menu at the edit_posts capability level. Retrieve a valid cg_admin nonce from the page source.
3. Modify the RegistryUserRole option: Submit a crafted POST request to the change-options-and-sizes.php handler with the RegistryUserRole parameter set to administrator and the valid cg_admin nonce. The handler will save this value to the contest_gal1ery_registry_and_login_options database table without role allowlist validation.
4. Register a new Google account: Trigger the Google sign-in registration flow on the target site to create a new WordPress user account.
5. Achieve Administrator access: The cg_create_wp_user_from_google_user function reads the attacker-controlled RegistryUserRole value (administrator) from the database and passes it to wp_update_user(), automatically promoting the new Google account to Administrator role — granting full site control (Feedly).

• Logs: WordPress access logs showing POST requests to the Contest Gallery option-saving handler (change-options-and-sizes.php) from Author/Contributor-level user accounts; unexpected user role changes in wp_usermeta or audit logs showing administrator role assignment to newly registered accounts.
• Database: The contest_gal1ery_registry_and_login_options table containing RegistryUserRole set to administrator when it should reflect a lower-privilege role.
• User Accounts: Newly created WordPress Administrator accounts associated with Google sign-in that were not provisioned by site administrators; unexpected entries in wp_users with recent registration timestamps and Administrator role.
• File System: No specific file artifacts expected, but monitor for new plugin installations or theme modifications made by unauthorized Administrator accounts following privilege escalation (Feedly).

Update the Contest Gallery plugin to a version beyond 30.0.2 as soon as a patched release becomes available. In the interim, restrict the edit_posts capability to trusted users only and disable Google sign-in registration if not required. Audit all existing WordPress user accounts for unauthorized Administrator-level accounts, particularly those registered via Google sign-in. Monitor new user registrations and implement role-based access controls to limit plugin admin page access (Feedly, Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for June 15–21, 2026, highlighting it as a notable privilege escalation issue in the WordPress plugin ecosystem (Wordfence). The vulnerability has been indexed by multiple threat intelligence aggregators including VulnDB, ENISA EUVD, and CVEFeed, indicating broad awareness in the security community. No significant social media controversy or vendor public statement has been observed beyond standard advisory publication.