Envira Gallery CVE-2026-104681

Requires an authenticated WordPress account with at least the Author role (the default capability to create and edit Envira galleries); no special non-default configuration is needed, and the vulnerable behavior exists out of the box in versions before 1.16.2. Exploitation is limited by: (1) the need for a valid Author-or-above account on the target site, (2) disclosure scope restricted to only the title and excerpt of hidden posts (private/draft/pending/trashed) - not their full body, and (3) no write/modify or denial-of-service capability. Sites that do not provision Author-level or higher accounts to untrusted parties are effectively not exposed.

This is a low-severity information-disclosure issue (vendor CVSS 2.7, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) and should be treated as a hardening/defense-in-depth fix rather than an emergency. The signals are internally consistent toward LOW real-world risk: the scope is tightly limited to disclosing only the title and excerpt of other users' private, draft, pending, and trashed posts - no full content, no integrity or availability impact (C:L/I:N/A:N). Publicly available exploit code exists (WPScan), which modestly raises the chance of opportunistic abuse, but exploitation is NOT confirmed in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread exploitation - POC availability must not be conflated with in-the-wild exploitation. One notable tension: the vendor vector sets PR:H, yet the description states the vulnerable capability belongs to 'Author and above by default' - the Author role is a relatively low, not high, privilege level in WordPress, so PR:L is arguably more accurate; this discrepancy slightly understates reachability (any Author-level account qualifies) but does not change the low impact ceiling. Bottom line: a genuine but minor multi-tenant confidentiality leak, relevant mainly to WordPress sites that grant Author+ accounts to semi-trusted or numerous users (e.g., multi-author blogs, membership sites); single-admin sites face negligible risk.

On a multi-author WordPress site, a logged-in user with the Author role (a default capability) creates a gallery and adds image/attachment identifiers they do not own; because the plugin never checks that the attachment belongs to a post the caller may view, the gallery response leaks the title and excerpt of other users' private, draft, pending, or trashed posts. Public exploit code is available via WPScan, making the technique trivially reproducible by any authenticated Author.