CVE-2025-11254
📋 TL;DR
This CSV injection vulnerability in the Contest Gallery WordPress plugin allows unauthenticated attackers to embed malicious formulas in exported CSV files. When victims download and open these files in spreadsheet applications like Excel, the formulas can execute arbitrary code on their local systems. All WordPress sites using Contest Gallery plugin versions up to 27.0.3 are affected.
💻 Affected Systems
- Contest Gallery - Upload, Vote & Sell with PayPal and Stripe WordPress plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on victim's local machine when malicious CSV file is opened in vulnerable spreadsheet software, potentially leading to full system compromise.
Likely Case
Data theft or malware installation on individual user workstations when malicious CSV files are opened by administrators or users.
If Mitigated
Limited impact if users open CSV files in text editors or properly configured spreadsheet software with formula execution disabled.
🎯 Exploit Status
Exploitation requires social engineering to convince users to download and open malicious CSV files. No authentication needed to submit malicious gallery entries.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 28.0.0
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3375891/contest-gallery/tags/28.0.0/functions/backend/render/cg-backend-gallery-general.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Contest Gallery' plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download version 28.0.0+ from WordPress plugin repository and manually update.
🔧 Temporary Workarounds
Disable gallery submissions
allTemporarily disable gallery submission functionality until patch can be applied
Sanitize CSV exports
wordpressAdd custom code to sanitize CSV output by prefixing formula characters with apostrophe
Add to theme functions.php or custom plugin: add_filter('contest_gallery_csv_export', 'sanitize_csv_output'); function sanitize_csv_output($data) { return preg_replace('/^[=+\-@]/', "'$0", $data); }
🧯 If You Can't Patch
- Educate users to never open CSV files from untrusted sources in spreadsheet applications
- Configure spreadsheet software to disable automatic formula execution for downloaded files
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Contest Gallery version. If version is 27.0.3 or lower, system is vulnerable.Check Version:
wp plugin list --name='contest-gallery' --field=version (if WP-CLI installed)Verify Fix Applied:
Verify plugin version is 28.0.0 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Multiple gallery submissions containing formula characters (=, +, -, @)
- Unusual CSV export requests
Network Indicators:
- CSV file downloads containing formula payloads in HTTP responses
SIEM Query:
source="wordpress" AND ("contest-gallery" OR "cg-backend-gallery") AND ("csv" OR "export") AND ("=" OR "+" OR "-" OR "@")🔗 References
- https://plugins.trac.wordpress.org/changeset/3375891/contest-gallery/tags/28.0.0/functions/backend/render/cg-backend-gallery-general.php?old=3372123&old_path=contest-gallery%2Ftags%2F27.0.3%2Ffunctions%2Fbackend%2Frender%2Fcg-backend-gallery-general.php
- https://plugins.trac.wordpress.org/changeset?old_path=/contest-gallery/tags/27.0.3&new_path=/contest-gallery/tags/28.0.0&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9a0dc62c-786d-40f3-b9c9-bd199a176192?source=cve
