CVE-2025-12849: Contest Gallery WordPress Auth Bypass Flaw

CVE-2025-12849 Overview

The Contest Gallery plugin for WordPress contains an authorization bypass vulnerability affecting all versions up to and including 28.0.2. The plugin registers the cg_check_wp_admin_upload_v10 AJAX action for both authenticated and unauthenticated users. The registration omits capability checks and nonce verification.

Unauthenticated attackers can inject arbitrary WordPress media attachments into galleries. Attackers can also manipulate gallery metadata through the same AJAX action. The flaw does not permit attackers to move or upload files to the server. The weakness is classified as [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated attackers can inject arbitrary media attachments into galleries and tamper with gallery metadata without any credentials or user interaction.

Affected Products

Contest Gallery plugin for WordPress, all versions up to and including 28.0.2
WordPress sites using the vulnerable cg_check_wp_admin_upload_v10 AJAX handler
Gallery configurations exposing media attachment and metadata endpoints

Discovery Timeline

2025-11-15 - CVE-2025-12849 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12849

Vulnerability Analysis

The vulnerability is an authorization bypass in the Contest Gallery plugin's AJAX handler. The plugin registers cg_check_wp_admin_upload_v10 using both wp_ajax_ and wp_ajax_nopriv_ hooks. This dual registration exposes the endpoint to unauthenticated users.

The handler does not call current_user_can() to verify caller privileges. It also skips check_ajax_referer() for nonce validation. Attackers reach the endpoint directly through /wp-admin/admin-ajax.php with the action=cg_check_wp_admin_upload_v10 parameter.

The endpoint accepts requests that attach existing WordPress media items to galleries. Attackers can supply arbitrary attachment IDs. The handler also processes gallery metadata fields without validating requester identity.

Root Cause

The root cause is missing authorization on a privileged AJAX action. WordPress requires developers to gate administrative AJAX handlers with capability checks and nonces. The Contest Gallery plugin registers an administrative upload verification action for anonymous callers and omits both controls. Refer to the WordPress Contest Gallery Function source for the vulnerable registration.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. Attackers send crafted POST requests to admin-ajax.php with the vulnerable action name. No authentication, credentials, or user interaction are required. The impact is limited to integrity of gallery contents and metadata. Confidentiality and availability remain unaffected. See the Wordfence Vulnerability Analysis for exploitation context.

Detection Methods for CVE-2025-12849

Indicators of Compromise

Unexpected media attachments appearing in Contest Gallery galleries that administrators did not add
POST requests to /wp-admin/admin-ajax.php containing action=cg_check_wp_admin_upload_v10 from unauthenticated sessions
Modified gallery metadata such as titles, descriptions, or ordering without corresponding administrator activity
Access log entries showing repeated hits to the cg_check_wp_admin_upload_v10 endpoint

Detection Strategies

Inspect web server access logs for requests referencing the cg_check_wp_admin_upload_v10 action parameter
Compare gallery attachment records against WordPress audit trails to identify anonymous modifications
Deploy web application firewall (WAF) rules that flag admin-ajax.php calls to this action from sessions lacking valid wordpress_logged_in_* cookies

Monitoring Recommendations

Enable WordPress audit logging plugins to capture changes to gallery posts and postmeta entries
Alert on high-frequency POST requests to admin-ajax.php originating from single IP addresses
Track database changes to Contest Gallery custom tables and the wp_postmeta table for gallery-related keys

How to Mitigate CVE-2025-12849

Immediate Actions Required

Update the Contest Gallery plugin to a version released after 28.0.2 that patches this authorization bypass
If no patched version is available, deactivate and remove the Contest Gallery plugin until a fix is published
Audit existing galleries for unauthorized attachments and revert unexpected metadata changes
Restrict access to admin-ajax.php at the WAF layer for the vulnerable action name

Patch Information

Review the WordPress Contest Gallery Developer Page for the latest release notes and security fixes. A patched version must enforce current_user_can() capability checks and check_ajax_referer() nonce validation on the cg_check_wp_admin_upload_v10 handler. Administrators should verify the plugin changelog before deployment.

Workarounds

Block requests to admin-ajax.php where the action parameter equals cg_check_wp_admin_upload_v10 and no valid authentication cookie is present
Add server-level rules to require authentication before reaching admin-ajax.php handlers registered by Contest Gallery
Temporarily remove the plugin's v10 directory to disable the vulnerable code path

bash

# Example nginx rule to block unauthenticated calls to the vulnerable action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "cg_check_wp_admin_upload_v10") {
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}