Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.7
CVE-2026-104682: Envira Gallery plugin lets contributors publish hidden galleries
CVE-2026-104682 · published 7 days ago
Summary
The Envira Gallery add‑on for WordPress (versions before 1.16.2) does not verify that a user has permission to create its own gallery content. As a result, users with only contributor rights can publish gallery posts that should be restricted. Upgrade the plugin to version 1.16.2 or later, or remove the feature if you cannot update.
What to do
- Update unknown envira gallery to version 1.16.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | envira gallery | < 1.16.2 |
Original advisory text
Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route
The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.7
Low
Type
CWE-862Missing Authorization
Timeline
Published11 Oct 2026
Updated15 Oct 2026
First seen11 Oct 2026
Track software like this
Free during beta