PT-2026-50255 · WordPress · Contest Gallery
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe versions prior to 30.0.3
Description
The plugin is subject to privilege escalation via the
RegistryUserRole parameter. The admin menu is registered at the edit posts capability level, allowing Contributor-level users to access admin pages and obtain a valid cg admin nonce. The option-saving handler in change-options-and-sizes.php fails to perform a current user can() capability check, relying only on check admin referer('cg admin'). Furthermore, the RegistryUserRole value is processed using sanitize text field() and htmlentities() without being restricted to an allowlist of permitted role names. This allows authenticated attackers with author-level access or higher to overwrite the stored RegistryUserRole option with administrator. The cg create wp user from google user() function then reads this value from the contest gal1ery registry and login options table and passes it to wp update user(), promoting newly registered Google sign-in accounts to Administrator status.Recommendations
Update the plugin to a version later than 30.0.2.
As a temporary workaround, restrict access to the
change-options-and-sizes.php file or the RegistryUserRole parameter to prevent unauthorized role modifications.Fix
LPE
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Contest Gallery