CVE-2026-104681
Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field
LOW 2.7EPSS 0.2%
The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.
- Affected
- Envira Gallery
- CVSS v3.1 CNA
- 2.7 LOW
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - EPSS
- 0.23% chance of exploitation in the next 30 days, 13th percentile
- Published
- 2026-10-11