CVE-2026-104680: Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard

Q: Which deployments are exposed to this issue?

The issue affects Envira Gallery versions before 1.16.2 when used in a WordPress Multisite environment. The affected privilege boundary is between a subsite Administrator and the network Super Admin.

Q: What access does an attacker need?

An attacker needs Administrator-level access to a Multisite subsite. They can use the setup wizard’s plugin-installation request without holding the capability normally required to install plugins network-wide.

Q: What could a successful attacker do?

A subsite Administrator can install an arbitrary plugin published on WordPress.org into the network-shared plugin directory, rather than being limited to Envira Gallery’s curated plugin list. This grants plugin-installation ability that WordPress normally reserves for the network Super Admin.

Q: What should be done if an upgrade cannot be applied immediately?

Restrict subsite Administrator access to trusted users and avoid allowing those users to use the Envira Gallery setup wizard for plugin installation. Review the network-shared plugin directory for unexpected WordPress.org plugins installed through the wizard.

Published Oct 11, 2026

Updated

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does not restrict the installation to its own curated list, allowing a Multisite subsite Administrator to install an arbitrary WordPress.org-published Envira Gallery WordPress plugin before 1.16.2 into the network-shared Envira Gallery WordPress plugin before 1.16.2 directory, a privilege Multisite reserves for the network Super Admin.

Affected Software

1 affected component

Envira Gallery Envira Gallery WordPress plugin<1.16.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Envira Gallery to a version that resolves this vulnerability.
Fixed in 1.16.2

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue affects Envira Gallery versions before 1.16.2 when used in a WordPress Multisite environment. The affected privilege boundary is between a subsite Administrator and the network Super Admin.

What access does an attacker need?

An attacker needs Administrator-level access to a Multisite subsite. They can use the setup wizard’s plugin-installation request without holding the capability normally required to install plugins network-wide.

What could a successful attacker do?

A subsite Administrator can install an arbitrary plugin published on WordPress.org into the network-shared plugin directory, rather than being limited to Envira Gallery’s curated plugin list. This grants plugin-installation ability that WordPress normally reserves for the network Super Admin.

What should be done if an upgrade cannot be applied immediately?

Restrict subsite Administrator access to trusted users and avoid allowing those users to use the Envira Gallery setup wizard for plugin installation. Review the network-shared plugin directory for unexpected WordPress.org plugins installed through the wizard.

CVE-2026-104680: Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

What could a successful attacker do?

What should be done if an upgrade cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

What could a successful attacker do?

What should be done if an upgrade cannot be applied immediately?