CVE-2026-104684 Overview
The Envira Gallery WordPress plugin contains an Insecure Direct Object Reference (IDOR) vulnerability in versions prior to 1.16.2. The plugin fails to verify that a user is authorized to read a gallery before rendering it. Authors with legitimate posting privileges can embed other users' non-public galleries into their own posts. This exposes gallery metadata belonging to other users to unauthenticated visitors of the site. The flaw maps to [CWE-639: Authorization Bypass Through User-Controlled Key].
Critical Impact
Authenticated authors can disclose other users' non-public gallery metadata to any unauthenticated site visitor by embedding gallery references in their own content.
Affected Products
- Envira Gallery WordPress plugin versions prior to 1.16.2
Discovery Timeline
- 2026-10-11 - CVE-2026-104684 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-104684
Vulnerability Analysis
The Envira Gallery plugin renders galleries based on an identifier supplied by the embedding user. The rendering path does not evaluate whether the requesting user, or the user who authored the embedding post, has permission to view the referenced gallery. An author account can therefore reference a gallery owned by another user, including non-public galleries, and have its metadata rendered when a visitor loads the published post.
Because gallery output is served through standard post rendering, the data becomes available to unauthenticated visitors once the author publishes the post. The scope is limited to gallery metadata exposure. The vulnerability does not provide write access, code execution, or site availability impact.
Root Cause
The root cause is a missing authorization check in the gallery rendering function. The plugin treats the gallery identifier as a trusted input and resolves it directly to stored gallery data without validating ownership or visibility settings. This pattern is the defining characteristic of [CWE-639].
Attack Vector
Exploitation requires an authenticated account with content-authoring privileges on the target WordPress site. The attacker embeds a reference to a target gallery, by its identifier, inside a post or page they control. On publication, the server-side plugin renders the gallery without checking whether the embedding author or the viewing visitor is permitted to see it. The attack vector is network-based and does not require user interaction beyond normal site browsing.
No verified public exploit code is available. See the WPScan Vulnerability Report for technical references.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-104684
Indicators of Compromise
- Posts or pages authored by non-administrator users that contain Envira Gallery shortcodes or block references pointing to gallery IDs the author does not own.
- Database records in wp_posts where post_author differs from the owner of the referenced Envira gallery post type.
- Access log entries showing unauthenticated requests retrieving gallery assets associated with galleries marked non-public.
Detection Strategies
- Audit published content for Envira Gallery embeds and cross-reference the embedded gallery ID against the gallery's original author.
- Review recent author-level account activity for atypical publishing patterns that reference gallery IDs outside the author's own content set.
- Compare the installed plugin version against 1.16.2 across all managed WordPress installations.
Monitoring Recommendations
- Enable WordPress audit logging for post creation and update events, capturing author identity and shortcode payloads.
- Monitor plugin version drift through configuration management to flag any site still running Envira Gallery below 1.16.2.
- Alert on new author account registrations followed by rapid post publication that references gallery shortcodes.
How to Mitigate CVE-2026-104684
Immediate Actions Required
- Update the Envira Gallery plugin to version 1.16.2 or later on all WordPress installations.
- Review existing posts for unauthorized gallery embeds and unpublish or remove them until the patch is applied.
- Audit author-level accounts and remove any that are inactive or unnecessary to reduce the exploitable account population.
Patch Information
The vendor addressed the issue in Envira Gallery version 1.16.2 by adding authorization checks to the gallery rendering path. Administrators should apply the update through the WordPress plugin updater or by replacing plugin files manually. Confirm the installed version in wp-admin/plugins.php after upgrade.
Workarounds
- Restrict content-authoring capabilities so that only trusted users hold the author role or higher.
- Temporarily disable the Envira Gallery plugin on sites where updating is not immediately feasible and gallery exposure is a concern.
- Mark sensitive galleries as draft or move them to a separate site instance until the patch is applied.
# Verify installed Envira Gallery version via WP-CLI
wp plugin get envira-gallery --field=version
# Update Envira Gallery to the patched release
wp plugin update envira-gallery --version=1.16.2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
