This vulnerability, identified as CVE-2026-54190, affects Envira Photo Gallery versions up to 1.12.5 and is classified under CWE-862 (Missing Authorization). It allows unauthenticated attackers to bypass access controls, potentially modifying or disrupting the plugin's functionality without proper permissions. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but low integrity and high availability impacts. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The vulnerability allows unauthenticated attackers to bypass authorization controls, which can lead to unauthorized modification or disruption of the Envira Photo Gallery plugin's operations. While confidentiality is not affected, the integrity of data and availability of the service can be compromised. This could result in altered gallery content or denial of service conditions within affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Applying strict access controls at the web server or application firewall level may help mitigate unauthorized access attempts, but no vendor-provided mitigation or temporary fix is currently documented.