CVE-2026-104682: Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route

Q: Who can exploit this issue?

A user with contributor-level access can exploit it. The CVSS vector also indicates that exploitation requires high privileges, but no user interaction.

Q: What capability does exploitation provide?

An affected user can create and publish Envira Gallery gallery posts by using the gallery-conversion route, despite plugin settings that would otherwise prevent them from doing so.

Q: What authorization check is flawed?

The gallery-conversion feature checks whether the requester can edit an arbitrary post they specify, rather than checking whether they are authorized to create Envira Gallery gallery content.

Q: Which versions are affected?

Envira Gallery versions before 1.16.2 are affected. Updating to version 1.16.2 or later addresses the affected version range.

Published Oct 11, 2026

Updated

The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.

Affected Software

1 affected component

Envira Gallery Envira Gallery<1.16.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Envira Gallery to a version that resolves this vulnerability.
Fixed in 1.16.2

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with contributor-level access can exploit it. The CVSS vector also indicates that exploitation requires high privileges, but no user interaction.

What capability does exploitation provide?

An affected user can create and publish Envira Gallery gallery posts by using the gallery-conversion route, despite plugin settings that would otherwise prevent them from doing so.

What authorization check is flawed?

The gallery-conversion feature checks whether the requester can edit an arbitrary post they specify, rather than checking whether they are authorized to create Envira Gallery gallery content.

Which versions are affected?

Envira Gallery versions before 1.16.2 are affected. Updating to version 1.16.2 or later addresses the affected version range.

CVE-2026-104682: Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What capability does exploitation provide?

What authorization check is flawed?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What capability does exploitation provide?

What authorization check is flawed?

Which versions are affected?