Envira Gallery CVE-2026-104680

Requires a WordPress Multisite network AND an attacker authenticated as a subsite Administrator (PR:H) - this is NOT exploitable on standard single-site WordPress, where Administrators legitimately install plugins. The specific trigger is the Envira Gallery setup-wizard plugin-installation request, which omits the network capability check WordPress reserves for plugin installs and does not restrict targets to Envira's curated list. Limiting factors: the attacker must already hold subsite-Administrator credentials, the install only crosses a privilege boundary in Multisite deployments, and sites running Envira Gallery 1.16.2 or later are patched. No end-user interaction is required (UI:N).

This is a genuine but conditionally-gated privilege-escalation issue (CWE-269) rather than a drive-by critical. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) is internally consistent with the description: exploitation is network-reachable and low-complexity but requires PR:H - specifically an authenticated WordPress Multisite subsite Administrator. A publicly available exploit exists (WPScan), which raises practical risk, but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation - treat POC availability and active exploitation as distinct signals. The decisive limiting factor is deployment context: the flaw is only meaningful on WordPress Multisite networks where the attacker already holds subsite-Administrator rights, which narrows the realistic attacker population to insiders or compromised subsite-admin accounts in multi-tenant hosting. No SSVC decision data, EPSS probability, or KEV status was supplied, so automatability and exploitation-maturity cannot be scored from the input. Net: a real priority specifically for Multisite/multi-tenant WordPress operators, but a lower practical concern for single-site installs, which are unaffected by the privilege-boundary being crossed.

On a WordPress Multisite network, a user holding only subsite Administrator rights (e.g., a tenant on shared hosting) invokes the Envira Gallery setup-wizard installation request, which fails to check the network-level capability WordPress reserves for plugin installation. Because the handler does not restrict installs to Envira's curated list, the attacker installs an arbitrary WordPress.org-published plugin into the network-shared plugin directory, gaining code that executes across every subsite - a privilege reserved for the network Super Admin. A public proof-of-concept for this flaw has been published by WPScan.