CVE-2026-104681 in Envira Gallery Plugin
Summary
by MITRE • 10/11/2026
The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in Envira Gallery versions prior to 1.16.2 represents a significant access control failure within the WordPress ecosystem, specifically targeting the media handling mechanisms of the plugin. The core technical flaw lies in the absence of proper authorization checks when an image identifier is added to a gallery configuration. In standard WordPress operations, content visibility is strictly governed by post status and user roles; private posts are visible only to administrators or authors of that specific post, drafts remain hidden from all except their creators, pending items await review, and trashed items are logically removed from public view. However, the Envira Gallery plugin fails to verify whether the requesting user has legitimate permissions to access the media attachment associated with a given image ID. This oversight allows any authenticated user with at least Author-level privileges to bypass these standard WordPress security boundaries by simply inputting an image identifier that corresponds to restricted content into their own gallery settings.
From a technical perspective, this issue stems from insufficient validation of resource ownership and permission levels during the data retrieval process. When a user constructs or edits a gallery, they provide references to specific media files stored in the WordPress database. The plugin retrieves metadata for these images without cross-referencing them against the current user's capabilities or the post status associated with the original upload context. Consequently, the system returns sensitive information such as titles and excerpts from private, draft, pending, or trashed posts that should remain inaccessible to the requesting party. This behavior effectively neutralizes WordPress's built-in content privacy features for media assets managed through this specific plugin interface, creating a direct path for unauthorized data disclosure.
The operational impact of this vulnerability is primarily centered on information leakage and potential social engineering risks. While the attacker cannot directly execute code or gain full administrative control over the site via this vector alone, they can extract sensitive textual metadata from other users' unpublished content. This includes titles and excerpts that may contain confidential business strategies, personal details, or unreleased product information. For organizations relying on WordPress for internal communications or draft management, this exposure undermines data confidentiality guarantees. Furthermore, attackers could use the gathered information to craft more targeted phishing attacks against site administrators or authors by referencing specific unpublished content they should not have known about, thereby increasing the likelihood of successful credential theft or further compromise attempts.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor within the Common Weakness Enumeration framework. In terms of offensive security tactics, it maps closely to ATT&CK technique T1005 Data from Local System Retrieval, specifically where attackers gather sensitive information for later use in social engineering or further exploitation phases. The lack of verification against user permissions is a classic example of broken object level authorization, where the system trusts client-supplied identifiers without validating the requester's right to access those objects.
To mitigate this risk, site administrators must immediately update the Envira Gallery plugin to version 1.16.2 or later, which addresses these permission checks by ensuring that image retrieval operations respect WordPress core privacy settings and user role capabilities. Until an upgrade is performed, it is advisable to restrict gallery editing privileges to only those users who absolutely require them, ideally limiting access to Administrators only if the plugin's full feature set is not essential for lower-level roles. Additionally, implementing a Web Application Firewall with rules that monitor for unusual patterns in media ID requests can provide a layer of defense against automated exploitation attempts. Regular audits of user permissions and adherence to the principle of least privilege across all WordPress plugins are critical practices to prevent similar access control failures from occurring elsewhere on the platform.