CVE-2026-104681: Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field

Q: Who can exploit this issue in a typical WordPress installation?

Any authenticated user who can create and edit an Envira gallery can exploit it. The affected plugin grants this capability to Author-level users and above by default.

Q: What information can be disclosed?

An attacker can disclose the title and excerpt of other users' non-public WordPress posts, including private, draft, pending, and trashed posts. The issue does not state that post body content or other fields are exposed.

Q: What does an attacker need to do to exploit it?

They need to add an image identifier to a gallery that refers to a media attachment they are not permitted to view. The plugin fails to verify the caller's permission for that attachment.

Q: How can exposure be reduced before updating?

Restrict untrusted users' ability to create or edit Envira galleries, particularly Author-level accounts. Review who has those capabilities because those users may be able to retrieve non-public post titles and excerpts.

Q: Which versions are affected?

Envira Gallery versions before 1.16.2 are affected. Updating to version 1.16.2 or later removes the identified affected version range.

Published Oct 11, 2026

Updated

The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.

Affected Software

1 affected component

Envira Gallery Envira Gallery<1.16.2

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue in a typical WordPress installation?

Any authenticated user who can create and edit an Envira gallery can exploit it. The affected plugin grants this capability to Author-level users and above by default.

What information can be disclosed?

An attacker can disclose the title and excerpt of other users' non-public WordPress posts, including private, draft, pending, and trashed posts. The issue does not state that post body content or other fields are exposed.

What does an attacker need to do to exploit it?

They need to add an image identifier to a gallery that refers to a media attachment they are not permitted to view. The plugin fails to verify the caller's permission for that attachment.

How can exposure be reduced before updating?

Restrict untrusted users' ability to create or edit Envira galleries, particularly Author-level accounts. Review who has those capabilities because those users may be able to retrieve non-public post titles and excerpts.

Which versions are affected?

Envira Gallery versions before 1.16.2 are affected. Updating to version 1.16.2 or later removes the identified affected version range.

CVE-2026-104681: Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue in a typical WordPress installation?

What information can be disclosed?

What does an attacker need to do to exploit it?

How can exposure be reduced before updating?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue in a typical WordPress installation?

What information can be disclosed?

What does an attacker need to do to exploit it?

How can exposure be reduced before updating?

Which versions are affected?