CVE-2026-104680: Envira Gallery Privilege Escalation Flaw

CVE-2026-104680 Overview

CVE-2026-104680 affects the Envira Gallery WordPress plugin in versions prior to 1.16.2. The plugin fails to verify that a user holds the WordPress capability required to install plugins before processing its setup-wizard installation request. The flaw also does not restrict installations to the plugin's own curated list.

A Multisite subsite Administrator can install any arbitrary plugin published on WordPress.org into the network-shared plugin directory. WordPress Multisite reserves this privilege for the network Super Admin. The vulnerability maps to CWE-269: Improper Privilege Management.

Critical Impact
A subsite Administrator can escalate privileges across a WordPress Multisite network by installing arbitrary plugins into shared directories, enabling full compromise of all sites in the network.

Affected Products

Envira Gallery WordPress plugin versions prior to 1.16.2
WordPress Multisite installations running vulnerable Envira Gallery releases
Networks where subsite Administrators are not fully trusted operators

Discovery Timeline

2026-10-11 - CVE-2026-104680 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-104680

Vulnerability Analysis

The Envira Gallery plugin exposes a setup-wizard installation endpoint that triggers plugin installation into the WordPress plugins directory. On a Multisite deployment, this directory is network-shared, and any plugin installed there becomes available to every subsite in the network.

The wizard handler does not call current_user_can('install_plugins') or an equivalent capability check before invoking the install routine. It also does not constrain the installation source to a vetted allowlist curated by the plugin vendor. An authenticated attacker with the subsite Administrator role can therefore request installation of any plugin hosted on WordPress.org.

Successful exploitation grants the attacker a persistent foothold at the network level. Once an attacker-chosen plugin executes, it inherits PHP execution rights across the Multisite network, which exceeds the authority of a subsite Administrator.

Root Cause

The root cause is a missing authorization check combined with an unrestricted installation target. WordPress reserves plugin installation on Multisite for the Super Admin role, enforced through the install_plugins and manage_network_plugins capabilities. The plugin's setup-wizard handler skips both checks and accepts an attacker-supplied plugin slug.

Attack Vector

The attacker authenticates to a WordPress Multisite subsite with Administrator credentials. They then issue the setup-wizard installation request to the vulnerable plugin endpoint, supplying the slug of any WordPress.org-published plugin, including one containing attacker-controlled or backdoored code. The plugin is written to the network-shared directory and can subsequently be activated to run arbitrary PHP across the network.

No exploitation code is published. See the WPScan Vulnerability Report for the authoritative technical reference.

Detection Methods for CVE-2026-104680

Indicators of Compromise

Unexpected plugin directories appearing under wp-content/plugins/ on Multisite networks running Envira Gallery below 1.16.2
HTTP POST requests to Envira Gallery setup-wizard endpoints originating from subsite Administrator sessions
WordPress audit log entries showing plugin installation events not attributed to a Super Admin account
New or modified PHP files in the shared plugins directory with recent timestamps correlating to subsite Administrator logins

Detection Strategies

Review WordPress action logs for activated_plugin and installation events performed by non-Super-Admin roles
Monitor filesystem writes into wp-content/plugins/ and alert when the writing process is tied to subsite-scoped requests
Inspect web server access logs for requests to Envira Gallery wizard URIs followed by downloads from downloads.wordpress.org

Monitoring Recommendations

Enable file integrity monitoring on the plugins directory of all Multisite deployments
Forward WordPress and web server logs to a centralized SIEM and alert on plugin installation events from non-network administrators
Baseline the expected plugin inventory per network and alert on deviations

How to Mitigate CVE-2026-104680

Immediate Actions Required

Upgrade the Envira Gallery plugin to version 1.16.2 or later on every site in the Multisite network
Audit wp-content/plugins/ for unexpected plugins installed after the vulnerable version was deployed
Rotate credentials for all subsite Administrator accounts and review their recent activity logs
Temporarily restrict Administrator role assignments on subsites until patching is complete

Patch Information

Upgrade Envira Gallery to version 1.16.2 or later, which adds the missing capability check and restricts installation targets. Refer to the WPScan Vulnerability Report for vendor fix details.

Workarounds

Deactivate the Envira Gallery plugin network-wide until the patched version is deployed
Define the DISALLOW_FILE_MODS constant in wp-config.php to block all plugin and theme installations via the WordPress UI
Reduce the number of subsite Administrator accounts and limit the role to trusted operators only

bash

# Configuration example: block plugin installations until patched
# Add to wp-config.php on the Multisite network
define( 'DISALLOW_FILE_MODS', true );