CVE-2026-104682: low-severity vulnerability in Envira Gallery
Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route
Published
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 2.7epss 0.2%
exploitation probability
0.2%top 90% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Envira Gallerypublic PoCs found — 1
cve_referencewpscan.com/vulnerability/faaa0c75-64d7-4e92-99a6-e60805d2080b/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Envira Gallery
In the same product, most dangerous first.
CVE-2026-104680HIGHEnvira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding WizardEPSS 0.3%CVE-2026-104653MEDIUMEnvira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop DimensionsEPSS 0.2%CVE-2026-104652MEDIUMEnvira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image IDEPSS 0.2%CVE-2026-104681LOWEnvira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST FieldEPSS 0.2%CVE-2026-104684LOWEnvira Gallery < 1.16.2 - Author+ IDOR via ShortcodeEPSS 0.2%