CVE-2026-104680
Received Received - Intake

Privilege Escalation in Envira Gallery WordPress Plugin

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does not restrict the installation to its own curated list, allowing a Multisite subsite Administrator to install an arbitrary WordPress.org-published Envira Gallery WordPress plugin before 1.16.2 into the network-shared Envira Gallery WordPress plugin before 1.16.2 directory, a privilege Multisite reserves for the network Super Admin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-104680
EUVD
EUVD-2026-96739

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Envira Gallery 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Envira Gallery WordPress plugin before version 1.16.2 has a vulnerability where it does not check if a user has the proper WordPress capability before allowing plugin installation. This lets a Multisite subsite Administrator install any plugin from WordPress.org into the network-shared plugins directory, which is normally restricted to network Super Admins.

Detection Guidance

Check the installed version of the Envira Gallery plugin. If it is below 1.16.2, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify versions.

Impact Analysis

This vulnerability allows unauthorized users with limited admin rights to install arbitrary plugins across the entire WordPress Multisite network. This could lead to malware infections, data breaches, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized plugin installations that may introduce security flaws or data leaks. GDPR and HIPAA require strict access controls and data protection, which this flaw undermines by enabling privilege escalation.

Mitigation Strategies

Update the Envira Gallery plugin to version 1.16.2 or later immediately. Remove any unauthorized plugins installed by untrusted users. Review user roles and capabilities in the WordPress Multisite environment to ensure only Super Admins can install network-wide plugins.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104680. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart