Vulnerability · Published Oct 11, 2026 · Assigned by WPScan

CVE-2026-104680Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard

High 7.2

In plain English

A high-severity privilege mismanagement in Envira Gallery from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.3%top 76.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does not restrict the installation to its own curated list, allowing a Multisite subsite Administrator to install an arbitrary WordPress.org-published Envira Gallery WordPress plugin before 1.16.2 into the network-shared Envira Gallery WordPress plugin before 1.16.2 directory, a privilege Multisite reserves for the network Super Admin.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Envira Gallery	0 – before 1.16.2

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/04e7dc2a-764e-4c0b-b929-d9f1881ef1ca/ exploit, vdb-entry, technical-description