CyberRota Analysis
AI-GeneratedThe Envira Gallery plugin for WordPress prior to version 1.16.2 is vulnerable due to insufficient verification of image identifiers, which allows users with gallery creation and editing permissions to access and disclose the titles and excerpts of other users' private, draft, pending, and trashed posts. This exposure of sensitive content poses a significant privacy risk within the WordPress environment. WordPress site administrators and users with Author roles or higher should prioritize updating to the latest version to mitigate this vulnerability.
Original NVD Description
The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.