Vulnerability · Published Oct 9, 2026 · Assigned by VulnCheck

CVE-2026-104079Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint

Medium 4.3

In plain English

A medium-severity missing authorization in Envira Gallery from Syed Balkhi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 91.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on the source post and uses a hard-coded publish status. Attackers can also supply arbitrary caller-controlled image IDs without ownership verification to publish unauthorized content using attachments they are not authorized to use.

Affected products (as reported)

Vendor	Product	Versions
Syed Balkhi	Envira Gallery	0 – before 1.16.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

Researcher Blog technical-description, exploit
WordPress Changelog patch, release-notes
VulnCheck Advisory: Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint third-party-advisory