Envira Photo Gallery EUVD-2026-37052

Exploitation requires no authentication and no user interaction, as confirmed by the CVSS vector (PR:N, UI:N, AV:N, AC:L). The Envira Photo Gallery plugin must be installed and active on a WordPress site running a version at or below 1.12.5. The WordPress site must be network-accessible to the attacker. No non-default configuration or special server-side condition has been documented as a prerequisite - the vulnerability is present in the plugin's default installed state. Limiting factors: impact is constrained to low integrity and low availability effects (C:N per CVSS), so confidential data exfiltration is not a confirmed outcome; exploitation does not escalate to full site compromise based on available data.

The CVSS 3.1 score of 6.5 (Medium) is driven by AV:N/AC:L/PR:N/UI:N - network-reachable, trivially exploitable with zero privileges or user interaction, consistent with the 'Unauthenticated' tag from Patchstack. The limited impact metrics (I:L, A:L, C:N) constrain the score from reaching high severity. No EPSS data was provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing exists, and no public proof-of-concept exploit has been identified, reducing the urgency compared to actively exploited issues. Real-world risk is best characterized as moderate-to-elevated for affected WordPress deployments: the near-frictionless attack conditions (no auth, low complexity, network accessible) lower the barrier for opportunistic scanning campaigns against WordPress sites, even if impact per exploitation event is limited. The absence of a confirmed patch version in available data is a meaningful gap - administrators cannot verify remediation without independently checking the WordPress plugin repository or Patchstack advisory.

An unauthenticated attacker scans for WordPress sites running Envira Photo Gallery and sends a crafted HTTP POST or GET request directly to an unprotected plugin endpoint (such as an admin-ajax.php action or REST route) without any session token or credentials. Because the plugin does not verify the caller's identity or capability, the request succeeds and the attacker can modify gallery settings, delete or alter image entries, or trigger actions that degrade site availability. No proof-of-concept code has been publicly identified, but the low complexity of the attack vector makes it suitable for automated scanning tools.