CVE-2026-12165 describes a privilege escalation vulnerability in the Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe WordPress plugin. The plugin registers its admin menu at the 'edit_posts' capability level, granting Contributor-level users access to admin pages and a valid nonce. The option-saving handler lacks proper capability checks beyond nonce verification and processes the RegistryUserRole parameter without restricting it to an allowlist. Consequently, attackers with author-level access or above can overwrite the RegistryUserRole option with 'administrator'. The function cg_create_wp_user_from_google_user reads this value without validation and passes it to wp_update_user(), effectively granting administrator privileges to a newly registered Google sign-in account.

An authenticated user with author-level access or higher can escalate privileges to administrator by exploiting this vulnerability. This leads to full administrative control over the WordPress site, including the ability to modify content, install plugins, change settings, and potentially compromise the entire site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level and contributor-level user permissions carefully and monitor for suspicious privilege changes. Avoid granting Google sign-in registration capabilities to untrusted users. Follow vendor updates closely for an official patch or temporary mitigation.