CVE-2026-104682: CWE-862 Missing Authorization in Envira Gallery
Description
The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.
CVSS v3.1
Score 2.7low
Affected software
Envira Gallery
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-104682 describes a missing authorization vulnerability (CWE-862) in the Envira Gallery WordPress plugin prior to version 1.16.2. The vulnerability arises because the gallery-conversion feature checks if the requester can edit an arbitrary post they specify, instead of verifying if they are authorized to create or manage the plugin's own gallery content. This logic flaw permits users with contributor-level permissions to bypass intended restrictions and create or publish gallery posts that the plugin would otherwise withhold from them.
Potential Impact
Users with contributor-level access can exploit this vulnerability to create and publish gallery posts that should be restricted, potentially leading to unauthorized content publication within the WordPress site. This could undermine content control policies and lead to privilege escalation within the content management workflow.
Mitigation Recommendations
A fix is available in Envira Gallery version 1.16.2. Users should upgrade to version 1.16.2 or later to address this authorization issue. No other mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-02T08:22:34.360Z
- State
- PUBLISHED
Threat ID: 6acb2ddc2cdf04f656b78cdc
Added to database: 10/11/2026, 06:34:04 UTC
Last enriched: 10/11/2026, 07:18:35 UTC
Last updated: 10/11/2026, 12:18:59 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.