CVE-2026-104682: falha de baixa gravidade em Envira Gallery
Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route
Publicada em
28Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 2.7epss 0.1%
probabilidade de exploração
0.1%top 97% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Unknown · Envira GalleryPoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/faaa0c75-64d7-4e92-99a6-e60805d2080b/não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Envira Gallery
No mesmo produto, das mais perigosas para as menos.
CVE-2026-104653MEDIUMEnvira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop DimensionsEPSS 0.2%CVE-2026-104652MEDIUMEnvira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image IDEPSS 0.2%CVE-2026-104681LOWEnvira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST FieldEPSS 0.1%CVE-2026-104684LOWEnvira Gallery < 1.16.2 - Author+ IDOR via ShortcodeEPSS 0.1%CVE-2026-104680HIGHEnvira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding WizardEPSS 0.1%