Envira Gallery CVE-2026-104684

Exploitation requires an authenticated WordPress account with author-level (content-publishing) privileges on a site running Envira Gallery before 1.16.2; the attacker must be able to embed a gallery they do not own into published content. The exposed data is limited to other users' non-public gallery metadata (not full account or site compromise). Limiting factors: the site must permit multiple users/authors (single-author sites have no other galleries to expose), the attacker needs the author role (not merely a subscriber or anonymous visitor), and only metadata - not necessarily full private media - is disclosed. No user interaction by a victim is required; the disclosure occurs to visitors who view the attacker's published page.

This is a low-severity information disclosure issue (CVSS 2.7, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) best characterized as a broken-access-control / IDOR flaw (CWE-639) rather than a true authentication bypass. The CVSS vector requires elevated privileges (PR:H) and yields only low confidentiality impact with no integrity or availability impact, which aligns with the described effect: an authenticated author can cause other users' non-public gallery metadata to be exposed. A public exploit exists (WPScan), but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. Signals are consistent and point to LOW real-world priority: the POC raises the floor on exploitability, but the privilege requirement, lack of KEV, and metadata-only exposure cap the ceiling. One discrepancy worth noting: the input vector uses PR:H, yet the WordPress 'author' role described is a mid/low-privilege content role (typically modeled PR:L), so the input may slightly understate exploitability - verify the exact role required with the WPScan advisory. EPSS is missing, which limits probabilistic exploitation estimation.

An attacker who holds (or obtains, e.g. via a registration-open or multi-author site) a WordPress author account on a site running Envira Gallery before 1.16.2 embeds a gallery belonging to another user into their own post or page. Because the plugin does not verify read authorization before rendering, the non-public gallery's metadata is exposed to anyone - including unauthenticated visitors who view the published content. A public proof-of-concept for this behavior is available from WPScan.