Unauthorized Data Modification Vulnerability in Envira Photo Gallery Plugin for WordPress

CVE-2023-6742

Summary

The Envira Photo Gallery plugin for WordPress is susceptible to a vulnerability allowing authenticated attackers, with contributor access or higher, to execute unauthorized modifications of gallery data. This occurs due to inadequate capability checks in the 'envira_gallery_insert_images' function, thereby potentially affecting the integrity of media galleries across user posts. All versions up to and including 1.8.7.1 are impacted, making it crucial for users to apply available updates and ensure proper permissions for their WordPress installations. Immediate action is recommended to mitigate risks associated with this vulnerability.

References