CVE-2026-104680 in Envira Gallery Plugin
Summary
by MITRE • 10/11/2026
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does not restrict the installation to its own curated list, allowing a Multisite subsite Administrator to install an arbitrary WordPress.org-published Envira Gallery WordPress plugin before 1.16.2 into the network-shared Envira Gallery WordPress plugin before 1.16.2 directory, a privilege Multisite reserves for the network Super Admin.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in versions of the Envira Gallery WordPress plugin prior to release 1.16.2 represents a critical failure in access control logic within a multisite environment. This flaw specifically targets the setup-wizard functionality, which is designed to facilitate initial configuration and installation processes for new users or administrators. In standard WordPress operations, certain administrative actions are strictly gated by capability checks that verify whether the executing user possesses specific permissions defined by the core software. However, in this instance, the plugin fails to validate that a requesting user holds the requisite capabilities before proceeding with code execution related to its own installation routines. This oversight creates a significant security gap where privilege escalation can occur through legitimate interface interactions rather than exploiting complex injection or buffer overflow techniques.
The technical root cause lies in the absence of proper capability verification during the setup-wizard process. When an administrator initiates the plugin's installation sequence, the application does not confirm that the user has been granted the specific privileges reserved for network-level administration tasks. In a WordPress multisite configuration, the ability to install plugins across the entire network is a high-privilege action typically restricted to Super Administrators. By bypassing this check, the vulnerability allows any administrator of an individual subsite within the multisite network to execute code that effectively installs plugin components into shared directories. This behavior contradicts the fundamental security model of WordPress multisites, which relies on strict isolation and hierarchical permission structures to maintain system integrity across multiple distinct sites hosted under a single installation.
The operational impact of this vulnerability is severe due to its potential for lateral movement and persistent compromise within a networked environment. A malicious or compromised subsite administrator can exploit this flaw to install arbitrary versions of the Envira Gallery plugin, including potentially modified or backdoored variants published on WordPress.org but not vetted by the site owner's security protocols. Because the installation targets a directory shared across the multisite network, the consequences extend beyond the individual subsite where the action was initiated. The injected code becomes accessible to all sites within that network, effectively granting the attacker administrative-level access and execution capabilities across multiple domains or subdomains hosted on the same server infrastructure. This can lead to widespread data exfiltration, defacement of multiple sites, or further exploitation of other vulnerabilities present in the shared plugin environment.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves a user gaining access to resources or functions for which they have not been explicitly authorized. Furthermore, from an offensive security perspective such as the MITRE ATT&CK framework, this behavior is consistent with techniques involving privilege escalation and lateral movement within cloud environments or containerized systems like WordPress multisites. The attacker leverages existing low-level privileges (subsite administrator) to achieve high-level outcomes (network-wide plugin installation), thereby expanding their attack surface significantly without needing additional exploits for authentication bypasses.
To mitigate this risk, organizations running Envira Gallery on a WordPress multisite must immediately upgrade the plugin to version 1.16.2 or later, where these capability checks have been properly implemented and enforced. Until an update is applied, administrators should restrict subsite administrator privileges as much as possible, ensuring that only trusted individuals with network-level oversight can perform administrative actions. Additionally, implementing strict file integrity monitoring on the shared plugin directories can help detect unauthorized modifications resulting from this exploitation vector. Regular audits of user capabilities across all multisite subdomains are also recommended to ensure no excessive permissions have been granted inadvertently, thereby reducing the attack surface available for such privilege escalation attempts.