CVE-2026-104681
Received Received - Intake

Information Disclosure in Envira Gallery WordPress Plugin

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-104681
EUVD
EUVD-2026-96740

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Envira Gallery 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Envira Gallery WordPress plugin before version 1.16.2 has a flaw where it does not check if a user adding an image to a gallery has permission to view that image. This allows users with Author-level access or higher to see titles and excerpts of private, draft, pending, or trashed posts they should not be able to access.

Detection Guidance

Check if your Envira Gallery plugin version is below 1.16.2. Log in as an Author-level user and attempt to add an image to a gallery referencing a private or restricted post. If the post title or excerpt is visible, the vulnerability may exist.

Impact Analysis

If you use the Envira Gallery plugin before version 1.16.2, an attacker with Author-level access could view sensitive information from posts you intended to keep private. This includes titles and excerpts of unpublished or restricted content.

Compliance Impact

This vulnerability could lead to unauthorized access to private data, potentially violating GDPR or HIPAA requirements for data protection and access controls. Organizations using the vulnerable plugin may face compliance risks if sensitive data is exposed.

Mitigation Strategies

Update the Envira Gallery plugin to version 1.16.2 or later immediately. Temporarily restrict Author-level user permissions to reduce exposure until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart