CVE-2026-104682 Overview
CVE-2026-104682 affects the Envira Gallery WordPress plugin in versions prior to 1.16.2. The plugin's gallery-conversion feature fails to verify that the requester has permission to create Envira Gallery content. Instead, it only confirms that the user can edit an arbitrary post they name. Contributor-level users can exploit this flaw to create and publish gallery posts that plugin settings should otherwise restrict. The vulnerability is classified under CWE-862: Missing Authorization.
Critical Impact
Authenticated contributors can bypass plugin role restrictions to create and publish Envira Gallery posts, undermining editorial access controls on affected WordPress sites.
Affected Products
- Envira Gallery WordPress plugin versions before 1.16.2
- WordPress sites with contributor-level or higher user accounts
- WordPress installations granting contributors restricted plugin access
Discovery Timeline
- 2026-10-11 - CVE-2026-104682 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-104682
Vulnerability Analysis
The Envira Gallery plugin exposes a gallery-conversion endpoint intended to transform existing posts into gallery content. The authorization check within this endpoint validates the wrong resource. It confirms the caller can edit the user-supplied post identifier rather than verifying permission to create plugin-managed gallery content.
This logic flaw lets a contributor nominate a post identifier they already control and convert it into a published Envira Gallery entry. The plugin bypasses its own role-based publishing restrictions as a result. The flaw is a textbook example of broken access control stemming from an incorrect authorization subject.
Root Cause
The root cause is a missing authorization check [CWE-862] in the gallery-conversion handler. The code evaluates current_user_can('edit_post', $post_id) semantics against an attacker-controlled target rather than checking a capability tied to Envira Gallery creation or publication. Authorization decisions bound to the wrong object allow privilege boundaries defined by the plugin configuration to be ignored.
Attack Vector
An attacker needs an authenticated contributor-level account on the target WordPress site. The attacker invokes the gallery-conversion feature while supplying a post identifier they are permitted to edit. The handler accepts the request and produces a published Envira Gallery post, bypassing the publish restriction normally enforced for contributors. Exploitation requires no user interaction and is performed over the network against the WordPress admin interface. See the WPScan Vulnerability Details for additional technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-104682
Indicators of Compromise
- Envira Gallery posts authored by users whose role does not normally allow publishing gallery content
- Published gallery posts whose creation timestamp aligns with contributor account activity
- Unexpected POST requests from contributor sessions to Envira Gallery conversion endpoints
Detection Strategies
- Audit the wp_posts table for envira post type entries authored by contributor-role users
- Review web server logs for AJAX or admin-ajax calls referencing Envira Gallery conversion actions originating from low-privilege sessions
- Correlate WordPress audit log plugin events for publish_post actions on gallery content outside expected editor workflows
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record post creation, role changes, and plugin configuration edits
- Alert on gallery publication events initiated by non-editor accounts
- Baseline normal contributor behavior and flag deviations such as cross-post-type publishing
How to Mitigate CVE-2026-104682
Immediate Actions Required
- Upgrade the Envira Gallery plugin to version 1.16.2 or later on all WordPress installations
- Review contributor accounts for unauthorized gallery posts and unpublish or delete any created without approval
- Audit the user list for unused or stale contributor accounts and remove them
Patch Information
The vendor addressed the authorization flaw in Envira Gallery version 1.16.2. The fix enforces capability checks tied to Envira Gallery content creation rather than the editability of an attacker-supplied post. Administrators should apply the update through the WordPress plugin dashboard or by downloading the current release from the official plugin repository.
Workarounds
- Temporarily remove the contributor role from untrusted accounts until the plugin is patched
- Restrict access to wp-admin/admin-ajax.php for low-privilege roles using a web application firewall rule
- Disable the Envira Gallery plugin if an immediate upgrade is not feasible and gallery functionality is non-essential
# Update Envira Gallery via WP-CLI
wp plugin update envira-gallery --version=1.16.2
# Verify the installed version
wp plugin get envira-gallery --field=version
# List all contributor accounts for review
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
