CVE-2025-11448 Overview
CVE-2025-11448 affects the Envira Photo Gallery plugin for WordPress. The plugin fails to enforce capability checks on the /envira-convert/v1/bulk-convert REST API endpoint. Authenticated users with contributor-level access or higher can invoke the endpoint to convert galleries into Envira galleries without authorization. The issue is present in all versions up to and including 1.11.0. The weakness is classified as Missing Authorization [CWE-862].
Critical Impact
Contributor-level accounts can trigger unauthorized bulk conversion of galleries through the REST API, resulting in integrity impact to site content.
Affected Products
- Envira Photo Gallery plugin for WordPress (envira-gallery-lite)
- All versions up to and including 1.11.0
- WordPress sites permitting contributor-level or higher registrations
Discovery Timeline
- 2025-11-08 - CVE-2025-11448 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11448
Vulnerability Analysis
The Envira Photo Gallery plugin registers a REST route at /envira-convert/v1/bulk-convert intended to convert existing galleries into the plugin's native format. The route handler omits a capability check, so WordPress only validates the caller's authentication cookie or application password without evaluating whether the user holds an appropriate role. Any authenticated account at contributor level or above can send requests to the endpoint and trigger conversion operations that should be reserved for editors or administrators. The vulnerability results in an integrity impact on gallery content while leaving confidentiality and availability unaffected.
Root Cause
The root cause is a missing permission_callback enforcement in the Convert_Gallery_REST handler. The endpoint registration relies on default REST authentication without invoking current_user_can() to confirm the caller holds manage_options, edit_others_posts, or an equivalent capability. The upstream patch in WordPress Plugin Changeset 3387243 introduces a capability check that rejects requests from low-privileged roles.
Attack Vector
Exploitation requires network access to the WordPress REST API and valid credentials for at least a contributor account. The attacker sends an authenticated HTTP request to /wp-json/envira-convert/v1/bulk-convert. The handler processes the request and converts targeted galleries without enforcing the caller's role. No user interaction is required beyond the authenticated request. Additional technical detail is available in the Wordfence Vulnerability Report.
Detection Methods for CVE-2025-11448
Indicators of Compromise
- POST requests to /wp-json/envira-convert/v1/bulk-convert from non-administrative user sessions.
- Unexpected creation or modification of Envira gallery posts attributed to contributor or author accounts.
- Audit log entries showing bulk conversion operations that do not correlate with editorial workflow.
Detection Strategies
- Review WordPress access logs for requests to the vulnerable REST route and correlate the authenticated user's role.
- Enable WordPress audit logging plugins to capture REST API activity and role context per request.
- Alert on gallery post creation events sourced from accounts that do not normally publish media.
Monitoring Recommendations
- Monitor HTTP request patterns targeting /wp-json/envira-convert/ paths and baseline normal usage.
- Track newly registered contributor accounts followed by REST API activity within a short interval.
- Forward WordPress and web server logs into a centralized analytics platform for cross-account correlation.
How to Mitigate CVE-2025-11448
Immediate Actions Required
- Upgrade Envira Photo Gallery to a version above 1.11.0 that includes the fix from changeset 3387243.
- Audit existing contributor and author accounts for legitimacy and rotate credentials for any suspicious users.
- Review Envira galleries created during the exposure window for unauthorized modifications.
Patch Information
The vendor addressed the missing capability check in WordPress Plugin Changeset 3387243. Site administrators should update to the latest release of the Envira Photo Gallery plugin through the WordPress plugin directory or the site's automatic update mechanism.
Workarounds
- Restrict user registration to trusted individuals and disable open contributor sign-up until patched.
- Deploy a Web Application Firewall rule that blocks unauthenticated and low-privileged requests to /wp-json/envira-convert/v1/bulk-convert.
- Temporarily deactivate the Envira Photo Gallery plugin if patching is not immediately possible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.