Envira Gallery CVE-2026-104682

Exploitation requires an authenticated WordPress account at contributor level or similar low-trust role on a site running Envira Gallery before 1.16.2; it is NOT remotely exploitable by anonymous users despite AV:N. The specific trigger is the plugin's gallery-conversion feature, which checks whether the requester can edit an arbitrary post they name rather than whether they are authorized to create Envira gallery content - so the attacker must supply/name a post they are permitted to edit. Limiting factors: requires a valid low-privilege account, affects only the gallery content-creation boundary (no code execution, data disclosure, or site takeover), and is remediated by upgrading to 1.16.2.

This is a genuinely low-priority issue that the signals agree on. The provided CVSS 3.1 base score is only 2.7, driven by limited integrity impact (I:L) with no confidentiality or availability consequence - the flaw lets an already-authenticated low-privilege user create/publish gallery content they should not, not exfiltrate data or take over the site. No EPSS score and no KEV listing were supplied; exploitation status is 'publicly available exploit code exists' (WPScan POC) but there is NO evidence of active exploitation, and POC availability must not be conflated with in-the-wild use. One internal inconsistency: the provided vector states PR:H (high privileges), yet the description explicitly says 'contributor-level access' is sufficient, which is a LOW-privilege authenticated role - the PR:H in the input appears too strict and likely understates how easily a low-trust account can trigger it. Net: real but minor; a privilege/authorization boundary weakness exploitable only by users who already have an authenticated contributor account, with no path to code execution or data disclosure.

An attacker with a contributor account on a WordPress site running Envira Gallery (e.g. a guest author, or an account obtained via weak registration) invokes the gallery-conversion feature and names a post they are permitted to edit, bypassing the intended restriction so the plugin creates and publishes gallery posts the site's settings would normally withhold from contributors. A public proof-of-concept exists via WPScan; exploitation is network-reachable (AV:N) and low-complexity (AC:L) but requires a valid authenticated account.