CVE-2026-54190: Envira Gallery Auth Bypass Vulnerability

CVE-2026-54190 Overview

CVE-2026-54190 is a broken access control vulnerability affecting the Envira Photo Gallery WordPress plugin in versions up to and including 1.12.5. The flaw stems from a missing authorization check [CWE-862], allowing unauthenticated attackers to access functionality that should be restricted to privileged users. Because the plugin does not verify caller permissions before executing sensitive operations, remote attackers can interact with protected endpoints over the network without credentials or user interaction. The vulnerability impacts integrity and availability at a limited scope but does not expose confidential data directly.

Critical Impact
Unauthenticated remote attackers can abuse missing authorization checks in Envira Photo Gallery to manipulate plugin functionality on affected WordPress sites.

Affected Products

Envira Photo Gallery (envira-gallery-lite) WordPress plugin
All versions up to and including 1.12.5
WordPress sites running the vulnerable plugin

Discovery Timeline

2026-06-16 - CVE-2026-54190 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54190

Vulnerability Analysis

The vulnerability is classified as Broken Access Control under [CWE-862] Missing Authorization. The Envira Photo Gallery plugin exposes one or more actions that fail to validate whether the requester has the required capability or role before performing privileged operations. An attacker can reach the affected functionality directly over HTTP without authenticating to WordPress.

Successful exploitation allows limited modification of plugin state and limited disruption of gallery functionality. The attack requires no user interaction and no prior privileges, which lowers the barrier to abuse against any reachable WordPress site running the plugin. The EPSS data places the probability of observed exploitation at 0.196%.

Root Cause

The root cause is a missing authorization check on plugin endpoints. WordPress plugins typically protect privileged actions using current_user_can() capability checks combined with nonce validation through check_admin_referer() or wp_verify_nonce(). In the vulnerable versions, the plugin invokes sensitive handlers without enforcing these gates, treating unauthenticated requests as authorized.

Attack Vector

The attack vector is network-based. An attacker sends crafted HTTP requests to the WordPress site hosting the vulnerable plugin, targeting the unprotected plugin actions exposed through admin-ajax.php, the REST API, or front-end handlers. No authentication, session, or user interaction is required. Technical specifics of the affected endpoint are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-54190

Indicators of Compromise

Unauthenticated POST or GET requests to admin-ajax.php referencing Envira Gallery actions from unknown source IP addresses.
Unexpected modifications to gallery configurations, options, or attached media within the WordPress database.
Spikes in HTTP traffic targeting /wp-content/plugins/envira-gallery-lite/ paths from unauthenticated sessions.

Detection Strategies

Inventory WordPress installations and identify sites running Envira Photo Gallery at version 1.12.5 or earlier.
Review web server access logs for repeated requests to Envira-specific AJAX or REST endpoints lacking authentication cookies.
Correlate WordPress audit logs with web traffic to identify state changes that occurred without an authenticated administrator session.

Monitoring Recommendations

Enable WordPress audit logging to capture changes to plugin options and gallery content.
Forward web server and WordPress logs to a centralized analytics platform for anomaly detection.
Alert on anonymous requests to plugin endpoints that result in successful HTTP 200 responses with state-changing payloads.

How to Mitigate CVE-2026-54190

Immediate Actions Required

Upgrade Envira Photo Gallery to a version newer than 1.12.5 once the vendor releases a fix.
Restrict administrative endpoints such as admin-ajax.php and the WordPress REST API behind a web application firewall rule set.
Audit existing galleries and plugin settings for unauthorized modifications introduced before patching.

Patch Information

Review the Patchstack Vulnerability Report for the latest patched version and vendor guidance. Apply the update through the WordPress plugin manager or by deploying the fixed release through your standard plugin deployment process.

Workarounds

Deactivate the Envira Photo Gallery plugin until a patched version is installed if the site does not require gallery functionality.
Deploy WAF rules that block unauthenticated requests to Envira-specific AJAX actions and REST routes.
Restrict access to wp-admin and admin-ajax.php by source IP where operationally feasible.

bash

# Example WAF rule concept to block unauthenticated Envira AJAX actions
# Block requests to admin-ajax.php carrying Envira actions without a valid WordPress auth cookie
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1026541900,msg:'Block unauthenticated Envira Gallery action'"
  SecRule ARGS:action "@rx ^envira_" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"