CVE-2026-104079 in Envira Gallery Lite Plugin
Summary
by MITRE • 10/09/2026
Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on the source post and uses a hard-coded publish status. Attackers can also supply arbitrary caller-controlled image IDs without ownership verification to publish unauthorized content using attachments they are not authorized to use.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Envira Gallery Lite prior to version 1.16.2 represents a critical failure in access control mechanisms within the application's REST API implementation. Specifically, this flaw resides in the gallery conversion endpoint, which is designed to facilitate the transformation of existing content into galleries managed by the plugin. The core technical deficiency lies in the authentication and authorization logic employed during request processing. Instead of verifying that the requesting user possesses the necessary administrative or specific publishing capabilities for creating new gallery entities, the system performs an insufficient check limited only to edit permissions on a source post. This architectural oversight allows users with lower-privileged roles, such as contributors or authors who typically lack full site management rights, to bypass standard permission gates and execute actions reserved for higher-level administrators.
From a technical perspective, the exploitation vector relies on manipulating HTTP requests sent to the vulnerable REST endpoint. The application logic incorrectly assumes that if a user can edit a specific source post, they should also be permitted to convert it into a gallery with published status. Furthermore, the validation process fails to enforce ownership constraints on image attachments referenced in the request payload. Attackers can supply arbitrary, caller-controlled identifiers for images without any verification of whether those assets belong to or are accessible by the authenticated user. This lack of object-level authorization check enables the unauthorized publication of content using media files that the attacker does not own, effectively bypassing both role-based access controls and resource ownership policies inherent in WordPress security models.
The operational impact of this vulnerability is significant for any website running an affected version of Envira Gallery Lite. Successful exploitation allows malicious actors to create and publish galleries without proper authorization, which can lead to defacement, the injection of misleading or harmful content, and potential phishing campaigns if linked media contains deceptive elements. Additionally, because attackers can reference arbitrary image IDs, they may be able to expose sensitive internal images that were not intended for public viewing, leading to data leakage and privacy violations. This capability undermines the integrity of the website's content management system and erodes trust in the platform's security posture, particularly in environments where multiple users with varying privilege levels contribute content.
This vulnerability aligns closely with CWE-269, which describes Improper Privilege Control, as it involves a user obtaining privileges they are not entitled to through flawed logic checks. It also maps to ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials but exploit misconfigurations or code flaws to perform unauthorized actions. To mitigate this risk, site administrators must immediately update Envira Gallery Lite to version 1.16.2 or later, which addresses these authorization checks by implementing proper capability verification for gallery creation and enforcing strict ownership validation on image attachments. Until the patch is applied, limiting user roles that have access to the REST API endpoints associated with gallery management can provide a temporary reduction in exposure, though upgrading remains the only definitive remediation strategy.