The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 30.0.2 via the RegistryUserRole parameter. This is due to the plugin's admin menu being registered at the edit_posts capability level — granting Contributor-level users access to the plugin's admin pages and a valid cg_admin nonce — while the option-saving handler in change-options-and-sizes.php performs no current_user_can() capability check beyond check_admin_referer('cg_admin'), and the RegistryUserRole value is processed only through sanitize_text_field() and htmlentities() without restriction to an allowlist of permitted role names. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the plugin's stored RegistryUserRole option with administrator, which the cg_create_wp_user_from_google_user function then reads back from the contest_gal1ery_registry_and_login_options database table without any allowlist validation and passes directly to wp_update_user(), effectively promoting a newly registered Google sign-in account to Administrator.
References
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 30.0.2 via the
RegistryUserRoleparameter. This is due to the plugin's admin menu being registered at theedit_postscapability level — granting Contributor-level users access to the plugin's admin pages and a validcg_adminnonce — while the option-saving handler inchange-options-and-sizes.phpperforms nocurrent_user_can()capability check beyondcheck_admin_referer('cg_admin'), and theRegistryUserRolevalue is processed only throughsanitize_text_field()andhtmlentities()without restriction to an allowlist of permitted role names. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the plugin's storedRegistryUserRoleoption withadministrator, which thecg_create_wp_user_from_google_userfunction then reads back from thecontest_gal1ery_registry_and_login_optionsdatabase table without any allowlist validation and passes directly towp_update_user(), effectively promoting a newly registered Google sign-in account to Administrator.References