CVE-2026-104681

Name of the Vulnerable Software and Affected Versions Envira Gallery versions prior to 1.16.2

Description Insufficient verification of image identifiers within the plugin allows users with the ability to create and edit galleries (typically Author role and above) to access information they are not permitted to see. By adding a specific image identifier to a gallery, an attacker can disclose the title and excerpt of other users' private, draft, pending, and trashed posts.

Recommendations Update Envira Gallery to version 1.16.2 or later.