Envira Gallery Lite CVE-2026-104079

Requires a valid authenticated WordPress account with at least edit permission on a source post (PR:L), because the gallery conversion REST endpoint authorizes based on that source-post edit capability instead of the capability required to create/publish galleries. Exploitation is limited to deployments running Envira Gallery Lite before 1.16.2 and depends on the attacker being able to register or otherwise obtain any low-privileged account on the site; no administrator access, no user interaction, and no special non-default configuration are needed. Impact is bounded to unauthorized gallery creation/publishing and use of attachments the attacker does not own - there is no confidentiality or availability impact.

This is a genuine but moderate-severity issue, not a top-tier priority. The input provides only a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, 5.3 Medium), and all signals are internally consistent: network vector, low attack complexity, but low privileges required (PR:L) and only a limited integrity impact (VI:L) with no confidentiality or availability impact. This matches the description - an authenticated low-privileged user escalates their effective publishing capability. There is no CISA KEV listing and no POC/exploit code referenced, so the status is no public exploit identified at time of analysis. No EPSS score was provided, so exploitation probability cannot be quantified. SSVC framework data (exploitation status, automatable, technical impact) was not supplied and cannot be synthesized. The practical ceiling on risk is that an attacker must already hold a valid authenticated account on the WordPress site (PR:L), and the impact is confined to unauthorized content creation/publishing rather than data theft or server compromise. Net assessment: a credible privilege/authorization weakness worth patching promptly, but low urgency relative to unauthenticated RCE-class flaws.

A low-privileged authenticated WordPress user (e.g., a Contributor or Subscriber-level account) sends a crafted request to the Envira Gallery conversion REST endpoint, which only validates edit permission on the source post and forces a hard-coded 'publish' status. The user thereby creates and publishes Envira galleries they lack the capability for, and can reference arbitrary caller-supplied image/attachment IDs they do not own to publish unauthorized content. No public exploit code was identified, and exploitation requires an existing authenticated account on the target site.