OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-104684

LOW · CVSS 2.7 EPSS 0.22%

Source: NVD + CISA KEV + EPSS · Published 2026-10-11 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

The Envira Gallery plugin for WordPress versions prior to 1.16.2 is vulnerable due to inadequate authorization checks, which permit authors to expose non-public gallery metadata to unauthenticated users. This flaw could lead to unauthorized access to sensitive information, potentially compromising user privacy. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.

CVE
CVE-2026-104684
Severity
LOW
CVSS
2.7
EPSS
0.22%
WordPress

Original NVD Description

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.