CVE-2026-104681 Overview
CVE-2026-104681 affects the Envira Gallery WordPress plugin in versions prior to 1.16.2. The plugin fails to verify that an image identifier added to a gallery references a media attachment the caller is permitted to view. Any authenticated user with gallery creation privileges (Author role and above by default) can supply arbitrary attachment IDs. This exposes the title and excerpt of private, draft, pending, and trashed posts that WordPress would normally hide. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Authenticated authors can enumerate and read titles and excerpts of other users' non-public WordPress posts through the gallery image attachment handler.
Affected Products
- Envira Gallery WordPress plugin versions before 1.16.2
- WordPress sites allowing Author-level or higher accounts
- Multi-author WordPress deployments using Envira Gallery for media management
Discovery Timeline
- 2026-10-11 - CVE-2026-104681 published to the National Vulnerability Database
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-104681
Vulnerability Analysis
The Envira Gallery plugin accepts image identifiers from users building or editing a gallery. When processing those identifiers, the plugin retrieves attachment metadata and surfaces fields such as post_title and post_excerpt back to the caller. The code path does not confirm whether the current user has the read_post capability for the referenced attachment or its parent post.
WordPress applies capability checks that normally hide draft, pending, private, and trashed content from users who are not the author or an administrator. By routing a request through the gallery image handler with an arbitrary numeric ID, an attacker bypasses those checks and reads metadata that the standard post query would redact.
The disclosure scope is limited to titles and excerpts rather than full post bodies. The vulnerability requires an authenticated account with gallery editing rights, which constrains exploitation to insiders or compromised author accounts.
Root Cause
The plugin trusts the attachment ID submitted by the caller without performing an authorization check against the retrieved object. There is no call to current_user_can( 'read_post', $attachment_id ) or an equivalent gate before returning metadata. This is a broken access control pattern specific to the gallery image resolution logic.
Attack Vector
An attacker authenticates to WordPress with an Author (or higher) account. The attacker creates or edits an Envira gallery and iterates numeric post IDs when adding images. For each ID, the plugin returns the title and excerpt of the referenced post regardless of its visibility status. Enumeration across sequential IDs allows the attacker to harvest metadata for every non-public post on the site.
See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-104681
Indicators of Compromise
- Repeated AJAX or REST requests from Author-role accounts to Envira Gallery image endpoints with sequential or non-sequential attachment IDs.
- Gallery edit sessions that reference post IDs the account did not author.
- Spikes in gallery-related requests from accounts that rarely publish media.
Detection Strategies
- Review web server access logs for high-volume requests to Envira Gallery endpoints such as paths containing envira or envira-gallery with varying id parameters.
- Correlate WordPress audit logs with user roles to identify Author accounts enumerating attachment IDs outside their normal workflow.
- Deploy a WordPress audit logging plugin to capture gallery creation and modification events alongside the attachment IDs referenced.
Monitoring Recommendations
- Alert on any Author or Contributor account making bulk gallery edits in a short time window.
- Monitor outbound responses from admin-ajax.php and REST endpoints for payloads containing titles of draft or private posts.
- Baseline normal gallery usage per author and flag deviations in request volume or ID ranges.
How to Mitigate CVE-2026-104681
Immediate Actions Required
- Upgrade Envira Gallery to version 1.16.2 or later on all WordPress sites.
- Audit Author-level and higher accounts and remove unused or stale credentials.
- Review recent gallery creation activity for enumeration patterns across unrelated attachment IDs.
Patch Information
The vendor fixed the issue in Envira Gallery 1.16.2 by enforcing an authorization check on the attachment identifier before returning metadata. Refer to the WPScan Vulnerability Report for version details and advisory references.
Workarounds
- Restrict gallery creation to trusted administrators by removing the capability from the Author role until the patch is applied.
- Place the WordPress admin area behind an additional authentication layer such as HTTP basic auth or an IP allowlist.
- Disable the Envira Gallery plugin on multi-author sites that cannot immediately upgrade.
# Configuration example: remove gallery capability from Author role via WP-CLI
wp cap remove author envira_gallery_create
wp cap remove author envira_gallery_edit
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
