CVE-2026-104680

Name of the Vulnerable Software and Affected Versions Envira Gallery WordPress plugin versions prior to 1.16.2

Description The plugin fails to verify if a user possesses the required installation capabilities before processing a setup-wizard installation request. Additionally, it does not restrict installations to a curated list. This allows a Multisite subsite Administrator to install any WordPress.org-published plugin into the network-shared directory, a privilege normally reserved for the network Super Admin.

Recommendations Update the Envira Gallery WordPress plugin to version 1.16.2 or later.