CVE-2026-104684 — Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode

CVE-2026-104684

Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode PUBLISHED

Description (CNA)

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.

Affected (CNA)

Vendor / product	Versions
Unknown / Envira Gallery	affected 0 before 1.16.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/b7963d03-d77c-4238-aff3-70b100250936/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.