Contest Gallery Privilege Escalation via 'RegistryUserRole' (CVE-2026-12165)

Vulnerability Overview Vulnerability Name: Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter CVE ID: CVE-2026-12165 CVSS Score: 8.8 (High) Publication Date: June 16, 2026 Last Updated: June 17, 2026 Researchers: Chloe Chamberland - Wordfence, PRISM Impact Scope Affected Software: Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe Software Type: Plugin Affected Versions: <= 30.0.2 Fixed Version: 30.0.3 Remediation Recommendation: Update to version 30.0.3 or a later patched version. Vulnerability Description The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin contains a privilege escalation vulnerability in versions 30.0.2 and earlier. This vulnerability exists because the plugin's admin menu is registered with the 'edit_posts' capability level, allowing users with the Contributor role to access the plugin's admin pages. In the options save handler 'change-options-and-sizes.php', the 'perform_no_current_user_can' capability check is bypassed. The 'RegistryUserRole' value is only processed through 'sanitize_text_field' and 'htmlentities', without restricting allowed capability names. This allows an attacker to escalate a newly registered Google login account to administrator status by overwriting the plugin-stored 'RegistryUserRole' option to 'administrator'. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Plugin Slug: contest-gallery (view on wordpress.org) Patched: Yes Fixed Version: 30.0.3 Recent Vulnerabilities Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection - CVE ID: CVE-2026-8912 - CVSS Score: 7.5 - Researcher: Leonid Semenenko (lsenenko) - Date: May 18, 2026 Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Missing Authorization - CVE ID: CVE-2026-42657 - CVSS Score: 5.3 - Researcher: endy - Date: April 29, 2026 Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Authenticated (Subscriber+) Sensitive Information Exposure - CVE ID: CVE-2026-42660 - CVSS Score: 4.3 - Researcher: Jakub Herman - Date: April 29, 2026 Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting - CVE ID: CVE-2026-42656 - CVSS Score: 6.4 - Researcher: endy - Date: April 29, 2026 Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Unauthenticated SQL Injection - CVE ID: CVE-2026-40771 - CVSS Score: 7.5 - Researcher: Trương Hữu Phúc (truonghuuphuc) - Date: April 21, 2026 Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion - CVE ID: CVE-2026-4021 - CVSS Score: 8.1 - Researcher: Supakid S. (m3kz) - Date: March 23, 2026 Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.2 - Missing Authorization - CVE ID: CVE-2026-25035 - CVSS Score: 5.3 - Researcher: daroo - Date: March 23, 2026 Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery - CVE ID: CVE-2026-24964 - CVSS Score: 6.4 - Researcher: limingwa13 - Date: March 10, 2026 Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection - CVE ID: CVE-2026-3180 - CVSS Score: 7.5 - Researcher: Thomas Sanzey - Date: March 2, 2026 Contest Gallery <= 28.1.1 - Missing Authorization - CVE ID: CVE-2026-24965 - CVSS Score: 4.3 - Researcher: limingwa13 - Date: January 9, 2026 Copyright Information Copyright 2012-2026 Defiant Inc. Copyright 1999-2026 The MITRE Corporation Contact Support: support@wordfence.com Business Hours Eastern Time: 9am-6pm ET Pacific Time: 6am-5pm PT UTC/GMT: 2pm-1am UTC/GMT Terms of Service Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Facebook Twitter LinkedIn Email Other Links Products Support News About Stay Updated Subscribe Sign up for news and updates from our panel of experienced security professionals. Disclaimer By checking this box I agree to the terms of service and privacy policy. Register SIGN UP Copyright © 2012-2026 Defiant Inc. All Rights Reserved Logos Wordfence Wordfence Intelligence Other Info Have you been hacked? Get Help Create Account Sign In View Pricing Products Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form

Goal Reached Thanks to every supporter — we hit 100%!

Contest Gallery Privilege Escalation via 'RegistryUserRole' (CVE-2026-12165)

More from this source