The Envira Photo Gallery plugin for WordPress suffers from a missing capability check (CWE-862) in multiple functions, enabling authenticated users with Author-level privileges or above to perform unauthorized modifications, including removing images from galleries. This affects all versions up to and including 1.12.0. The vulnerability was partially addressed in version 1.12.0, but no complete patch or official fix has been confirmed. The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with Author-level access or higher can modify gallery content without proper authorization, specifically by removing images from arbitrary galleries. There is no impact on confidentiality or availability reported. The integrity of gallery data is affected, which could disrupt content management or presentation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was partially patched in version 1.12.0, so updating to the latest plugin version is recommended if a newer version beyond 1.12.0 is available. Until a full fix is confirmed, restrict Author-level access to trusted users only to reduce risk.