CVE-2026-104681 Envira Gallery CVE debrief

Who should care

Defenders responsible for WordPress installations using the Envira Gallery plugin, especially those with multiple users or where users have gallery creation and editing permissions, should assess their exposure and potential impact.

Why it matters

This vulnerability allows users with gallery creation and editing permissions to disclose sensitive information from private, draft, pending, and trashed posts in WordPress installations using the Envira Gallery plugin before 1.16.2.

• Potential unauthorized disclosure of private post titles and excerpts
• Possible exploitation by users with gallery creation and editing permissions

Technical summary

The Envira Gallery WordPress plugin before 1.16.2 does not properly validate image identifiers added to galleries. This allows users with gallery creation and editing permissions to disclose titles and excerpts of private, draft, pending, and trashed posts in WordPress installations using the plugin. The vulnerability can be exploited by any user able to create and edit a gallery (Author and above by default). Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using the Envira Gallery plugin.

Recommended defensive actions

• Verify the version of the Envira Gallery plugin being used and check if it is vulnerable.
• Assess the impact of this vulnerability on the system and determine if any users can create and edit galleries.
• Consider upgrading to a patched version of the plugin, if available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact. The Envira Gallery plugin before 1.16.2 does not verify image identifiers added to galleries, which allows users with gallery creation and editing permissions to disclose titles and excerpts of private, draft, pending, and trashed posts. Defenders should verify exposure and assess the impact on their systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.