CVE-2026-104079: Envira Gallery Lite Auth Bypass Flaw

CVE-2026-104079 Overview

CVE-2026-104079 is a missing authorization vulnerability [CWE-862] in the Envira Gallery Lite WordPress plugin before version 1.16.2. The flaw resides in the plugin's gallery conversion REST endpoint. Lower-privileged authenticated users can create and publish Envira galleries without holding the required capabilities. The endpoint only validates edit permissions on the source post and uses a hard-coded publish status. Attackers can also pass arbitrary caller-controlled image IDs without ownership verification, letting them publish content using attachments they are not authorized to use.

Critical Impact

Authenticated low-privileged users can publish unauthorized gallery content on affected WordPress sites by abusing a REST endpoint that skips capability and ownership checks.

Affected Products

• Envira Gallery Lite WordPress plugin versions prior to 1.16.2
• WordPress sites that expose the plugin's gallery conversion REST endpoint
• Multi-author WordPress deployments where contributor or author roles are provisioned

Discovery Timeline

• 2026-10-09 - CVE-2026-104079 published to the National Vulnerability Database
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-104079

Vulnerability Analysis

The vulnerability resides in a REST API endpoint that converts an existing post into an Envira gallery. The handler performs an authorization check against the source post using an edit_post capability check. It does not verify that the calling user holds the capabilities required to create or publish an Envira gallery custom post type. The endpoint also hard-codes the resulting gallery's post status to publish, bypassing the normal moderation workflow that would otherwise apply to lower-privileged roles such as contributors.

A second authorization defect compounds the issue. The endpoint accepts a list of image attachment IDs supplied by the caller. It does not validate ownership of those attachments or confirm the caller is permitted to use them. An attacker can therefore reference arbitrary attachment IDs that belong to other users and publish them in a gallery under their control.

Root Cause

The root cause is a missing authorization check [CWE-862] in the REST route's permission_callback. Validating edit permission on the source post is insufficient. The handler never evaluates the capabilities required for the target action: creating and publishing an Envira gallery. Additionally, input handling for the attachment ID array lacks an ownership or capability boundary check.

Attack Vector

Exploitation requires an authenticated account with low privileges, such as a WordPress contributor, that can edit at least one post the attacker uses as the source. The attacker sends a crafted HTTP request to the plugin's gallery conversion REST endpoint. The request references the attacker-editable source post and supplies arbitrary attachment IDs. The server creates and publishes the gallery without a capability check, producing published content under the attacker's identity using images they do not own. See the VulnCheck Advisory for Envira Gallery Lite for the full technical write-up.

Detection Methods for CVE-2026-104079

Indicators of Compromise

• Published Envira gallery posts authored by low-privileged user accounts that normally lack publish capabilities
• REST API requests to the Envira Gallery Lite conversion endpoint from contributor or author accounts
• Gallery posts that reference attachment IDs belonging to other WordPress users
• Unexpected spikes in envira custom post type entries created outside normal editorial workflows

Detection Strategies

• Review WordPress audit logs for rest_api_init calls targeting the Envira Gallery Lite conversion route
• Correlate the author of newly published Envira galleries against the authenticated user's role and capabilities
• Compare attachment ownership metadata (post_author of attachment posts) against the author of the gallery embedding them
• Alert on any post transition to publish initiated by users who lack the publish_posts capability on that post type

Monitoring Recommendations

• Enable verbose logging for WordPress REST API traffic, including request path, HTTP method, and authenticated user ID
• Forward WordPress and web server logs to a centralized analytics backend for role-based anomaly detection
• Monitor plugin version inventory across all WordPress deployments to confirm Envira Gallery Lite is at 1.16.2 or later
• Baseline the normal rate of Envira gallery creation per role and alert on deviations

How to Mitigate CVE-2026-104079

Immediate Actions Required

• Upgrade Envira Gallery Lite to version 1.16.2 or later on every WordPress instance
• Audit existing Envira galleries for unauthorized posts created by low-privileged users
• Review user role assignments and remove unnecessary contributor or author accounts
• Rotate credentials for any suspected compromised low-privileged accounts

Patch Information

The vendor has addressed the issue in Envira Gallery Lite 1.16.2. The fix adds proper capability checks in the REST endpoint's permission_callback and validates ownership of supplied attachment IDs. Refer to the WordPress Envira Gallery Plugin page for release notes and download links.

Workarounds

• Temporarily disable the Envira Gallery Lite plugin until the patched version is deployed
• Restrict access to the WordPress REST API from unauthenticated and low-privileged sessions using a web application firewall rule
• Remove contributor and author roles from accounts that do not require content creation privileges
• Block requests to the plugin's gallery conversion REST route at the reverse proxy until upgrade

# Example WP-CLI commands to inventory and update the plugin
wp plugin get envira-gallery-lite --field=version
wp plugin update envira-gallery-lite --version=1.16.2
wp plugin deactivate envira-gallery-lite   # temporary workaround if patch cannot be applied immediately