Contest Gallery 插件权限提升漏洞 (CVE-2026-12165)

漏洞概述 漏洞名称: Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter CVE ID: CVE-2026-12165 CVSS 评分: 8.8 (High) 发布日期: 2026年6月16日 最后更新日期: 2026年6月17日 研究人员: Chloe Chamberland - Wordfence, PRISM 影响范围 受影响软件: Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe 软件类型: Plugin 受影响版本: <= 30.0.2 修复版本: 30.0.3 修复方案 修复建议: 更新到版本 30.0.3 或更新的已修复版本。 漏洞描述 Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe 插件在 30.0.2 及更早版本中存在权限提升漏洞。该漏洞是由于插件的 admin 菜单在注册时使用了 'edit_posts' 权限级别，允许 Contributor 级别的用户访问插件的 admin 页面。在选项保存处理程序 'change-options-and-sizes.php' 中，'perform_no_current_user_can' 权限检查被绕过，'RegistryUserRole' 值仅通过 'sanitize_text_field' 和 'htmlentities' 处理，没有限制允许的权限名称。这使得攻击者可以通过覆盖插件存储的 'RegistryUserRole' 选项为 'administrator'，从而将新注册的 Google 登录账户提升为管理员。 参考链接 plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org 其他信息 软件 Slug: contest-gallery (view on wordpress.org) 是否已修复: Yes 修复版本: 30.0.3 近期漏洞 Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection - CVE ID: CVE-2026-8912 - CVSS 评分: 7.5 - 研究人员: Leonid Semenenko (lsenenko) - 日期: 2026年5月18日 Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Missing Authorization - CVE ID: CVE-2026-42657 - CVSS 评分: 5.3 - 研究人员: endy - 日期: 2026年4月29日 Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Authenticated (Subscriber+) Sensitive Information Exposure - CVE ID: CVE-2026-42660 - CVSS 评分: 4.3 - 研究人员: Jakub Herman - 日期: 2026年4月29日 Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting - CVE ID: CVE-2026-42656 - CVSS 评分: 6.4 - 研究人员: endy - 日期: 2026年4月29日 Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Unauthenticated SQL Injection - CVE ID: CVE-2026-40771 - CVSS 评分: 7.5 - 研究人员: Trương Hữu Phúc (truonghuuphuc) - 日期: 2026年4月21日 Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion - CVE ID: CVE-2026-4021 - CVSS 评分: 8.1 - 研究人员: Supakid S. (m3kz) - 日期: 2026年3月23日 Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.2 - Missing Authorization - CVE ID: CVE-2026-25035 - CVSS 评分: 5.3 - 研究人员: daroo - 日期: 2026年3月23日 Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery - CVE ID: CVE-2026-24964 - CVSS 评分: 6.4 - 研究人员: limingwa13 - 日期: 2026年3月10日 Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection - CVE ID: CVE-2026-3180 - CVSS 评分: 7.5 - 研究人员: Thomas Sanzey - 日期: 2026年3月2日 Contest Gallery <= 28.1.1 - Missing Authorization - CVE ID: CVE-2026-24965 - CVSS 评分: 4.3 - 研究人员: limingwa13 - 日期: 2026年1月9日 版权信息 Copyright 2012-2026 Defiant Inc. Copyright 1999-2026 The MITRE Corporation 联系方式 技术支持: support@wordfence.com 业务时间 美国东部时间: 9am-6pm ET 美国太平洋时间: 6am-5pm PT UTC/GMT: 2pm-1am UTC/GMT 服务条款 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 Facebook Twitter LinkedIn Email 其他链接 Products Support News About Stay Updated 订阅 Sign up for news and updates from our panel of experienced security professionals. 免责声明 By checking this box I agree to the terms of service and privacy policy. 注册 SIGN UP 版权 © 2012-2026 Defiant Inc. All Rights Reserved 标志 Wordfence Wordfence Intelligence 其他信息 Have you been hacked? Get Help Create Account Sign In View Pricing 产品 Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central 支持 Documentation Learning Center Free Support Premium Support 新闻 Blog In The News Vulnerability Advisories 关于 About Wordfence Affiliate Program Employment Contact Security CVE Request Form 订阅 Sign up for news and updates from our panel of experienced security professionals. 免责声明 By checking this box I agree to the terms of service and privacy policy. 注册 SIGN UP 版权 © 2012-2026 Defiant Inc. All Rights Reserved 标志 Wordfence Wordfence Intelligence 其他信息 Have you been hacked? Get Help Create Account Sign In View Pricing 产品 Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central 支持 Documentation Learning Center Free Support Premium Support 新闻 Blog In The News Vulnerability Advisories 关于 About Wordfence Affiliate Program Employment Contact Security CVE Request Form 订阅 Sign up for news and updates from our panel of experienced security professionals. 免责声明 By checking this box I agree to the terms of service and privacy policy. 注册 SIGN UP 版权 © 2012-2026 Defiant Inc. All Rights Reserved 标志 Wordfence Wordfence Intelligence 其他信息 Have you been hacked? Get Help Create Account Sign In View Pricing 产品 Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Contest Gallery 插件权限提升漏洞 (CVE-2026-12165)

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Contest Gallery 插件权限提升漏洞 (CVE-2026-12165)

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！