Missing Authorization Vulnerability in Envira Gallery Lite by WordPress

CVE-2026-104079

What is CVE-2026-104079?

Envira Gallery Lite prior to version 1.16.2 features a missing authorization vulnerability in its gallery conversion REST endpoint. This flaw permits lower-privileged authenticated users to create and publish galleries without necessary permissions. The vulnerability arises because the endpoint evaluates edit permissions solely on the source post, and utilizes a hard-coded publish status. Consequently, attackers can manipulate controlled image IDs and publish unauthorized content using attachments they do not have the rights to access, thereby creating significant risks for site integrity and content management.

References