CVE-2026-104684 — Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other us…
Published: 2026-10-11 · CVSS: 2.7 · CVSS 3.1
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7