CVE-2026-104079

Executive Summary

CVE-2026-104079 is a missing authorization (CWE-862) vulnerability in the Envira Gallery Lite WordPress plugin affecting versions prior to 1.16.2. A REST endpoint used for gallery conversion performs only a source-post edit-permission check and applies a hard-coded publish status, allowing any lower-privileged authenticated user (for example, a Contributor) to create and publish Envira galleries and to reference arbitrary caller-controlled attachment IDs they do not own. Because exploitation requires an authenticated account but no user interaction and only low privileges, the flaw is rated CVSS 3.1 base 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) — an integrity-only impact with no confidentiality or availability effect.

Technical Analysis

The vulnerability resides in a REST endpoint that converts existing content into Envira galleries. According to the NVD description, two distinct control failures combine:

1. Insufficient authorization check on the conversion action. The endpoint validates only that the caller holds edit permissions on the source post being converted. It does not verify that the caller possesses the capabilities required to create or publish a new Envira gallery. These are separate authorization decisions: edit rights on one post do not imply the capability to publish new gallery content. This is a classic CWE-862 missing authorization condition — the privileged operation is reachable by a principal who was never granted the privilege for that operation.

2. Hard-coded publish status. The endpoint does not derive the resulting gallery's status from the caller's capabilities; it applies a fixed publish status. As a result, content that should have landed in a pending/draft state (subject to editorial review) is instead published immediately. This removes the moderation control that would otherwise constrain a low-privileged actor.

3. Unverified caller-controlled image IDs. The endpoint accepts image/attachment identifiers supplied by the caller without verifying that the caller owns or is authorized to use those attachments. This allows a lower-privileged user to reference media belonging to other users and republish it inside a gallery they control.

The attack surface is the plugin's REST API, which is network-reachable (AV:N) on any WordPress installation where Envira Gallery Lite is active and the endpoint is registered. Because the caller must be authenticated with sufficient rights on some source post to pass the single check that is performed, the privilege requirement is low (PR:L) rather than none. No special conditions or user interaction are needed (AC:L, UI:N), which makes the flaw trivially automatable once an attacker holds any qualifying account.

The NVD description does not disclose the exact REST route path, the parameter names carrying the image IDs, or the specific capability strings involved. Those implementation details are therefore intentionally omitted here rather than inferred. The mechanism — a single, scoped edit-permission check standing in for a broader capability check, combined with a hard-coded publish state and unvalidated attachment references — is fully sufficient to characterize the defect class and its exploitation.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE. The attack chain below is inferred strictly from the vulnerability class and the NVD description; no endpoint paths, parameter names, or function names are asserted beyond what the description provides.

1. Reconnaissance / target identification. An attacker identifies WordPress sites running the Envira Gallery Lite plugin below version 1.16.2. Plugin presence is observable from publicly served front-end assets and markup, making mass identification feasible without authentication. The attacker then needs at least one authenticated account with edit rights on at least one post — the lowest-privileged role that satisfies the endpoint's single check (for example, an author-level account, or any role with edit capability on a chosen post).

2. Triggering the missing authorization. With the low-privileged session, the attacker invokes the gallery conversion REST endpoint and supplies a source post they are permitted to edit. The endpoint authorizes the request based solely on that edit permission, so the request proceeds even though the attacker lacks the capability required to create/publish an Envira gallery.

3. Payload / execution at the vulnerability-class level. Two abuses are possible. First, the conversion produces a gallery that is published immediately because of the hard-coded publish status, bypassing moderation. Second, the attacker includes caller-controlled attachment/image identifiers in the request; since no ownership verification is performed, the resulting gallery can embed media belonging to other users. The attacker is effectively using the endpoint as an authorization-bypass primitive to publish content of their choosing under the site's brand.

4. Post-exploitation impact. The immediate effect is unauthorized content publication on the target site — reputational abuse, SEO poisoning, or staging of further social-engineering/malicious content — using attachments the attacker is not entitled to use. The scope is confined to integrity (I:L per CVSS); no confidentiality loss, availability loss, or scope change is described. There is no evidence in the provided data that this flaw alone yields remote code execution or privilege escalation to administrator.

Impact Assessment

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N decomposes as follows: the attack is remotely reachable over the network (AV:N), requires no special conditions (AC:L), needs only low privileges (PR:L), and requires no user interaction (UI:N). The scope is unchanged (S:U), and the impact is integrity-only and limited (I:L), with no confidentiality (C:N) or availability (A:N) impact. Base score: 4.3 (Medium).

Business impact centers on content integrity and brand trust. Affected systems are any WordPress deployment hosting Envira Gallery Lite versions prior to 1.16.2 — a large population, given the plugin's wide use. Blast radius is determined by how many accounts on a site hold any post-edit capability: on multi-author blogs, membership sites, and any property that grants contributor/author roles to untrusted parties, the effective attacker population is the entire low-privileged user base. The unverified attachment-ID weakness widens the blast radius to include media owned by other users, which may have licensing, privacy, or brand implications when republished without authorization. No EPSS score is available from FIRST.org, and the CVE is not listed in CISA KEV, so there is no confirmed evidence of active exploitation; that does not, however, reduce exposure on installs that host untrusted authenticated users.

Detection Guidance

Sigma Rule

title: Envira Gallery Lite Unauthorized Gallery Conversion Attempt
id: 5f1c9a2e-7b64-4d3a-9e02-cve2026104079
status: experimental
description: Detects requests to the Envira Gallery Lite gallery conversion REST endpoint originating from low-privileged roles or referencing suspicious attachment IDs.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104079
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: wordpress
  service: web
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/wp-json/'
      - 'envira'
      - 'convert'
  selection_method:
    cs-method: 'POST'
  condition: selection_endpoint and selection_method
falsepositives:
  - Legitimate administrators converting posts to galleries
level: medium
tags:
  - attack.t1190
  - cve.2026.104079
  - cwe.862

YARA Rule

rule CVE_2026_104079_Envira_Missing_Authorization
{
    meta:
        description = "Detects Envira Gallery Lite gallery conversion patterns indicative of CVE-2026-104079 misuse"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104079"
        cve = "CVE-2026-104079"
        date = "2026-01-01"
    strings:
        $ep1 = "envira" ascii nocase wide
        $ep2 = "convert" ascii nocase wide
        $ep3 = "/wp-json/" ascii wide
        $param1 = "attachment" ascii nocase wide
        $param2 = "gallery" ascii nocase wide
        $post = "POST" ascii
    condition:
        uint16(0) == 0x504B or
        (filesize < 1MB and ($ep1 and $ep2) and $ep3 and any of ($param*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104079 Envira Gallery Lite unauthorized gallery conversion attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"wp-json"; http.uri; content:"envira"; nocase; http.uri; content:"convert"; nocase; reference:cve,2026-104079; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104079; classtype:attempted-user; sid:2026104079; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.protocol == "http" and http.request.method == "POST"
     and http.request.body contains "envira"
     and http.request.body contains "attachment"]
  [network where network.protocol == "http" and http.response.status_code == 200
     and http.request.method == "POST"]

Splunk SPL Query

index=web (host=*wordpress* OR host=*wp*)
| eval uri = lower(coalesce(uri, cs_uri_stem, url))
| eval body = lower(coalesce(body, cs_uri_query, form_data))
| where match(uri, "wp-json.*envira|envira.*convert")
    AND method="POST"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as src_ips by uri, user, dest_host
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,envira,">
  <rule id="104079" level="8">
    <if_sid>31100</if_sid>
    <id>^31</id>
    <match>envira</match>
    <match>convert</match>
    <regex>POST .*(wp-json).*envira.*convert</regex>
    <description>CVE-2026-104079: Possible Envira Gallery Lite unauthorized gallery conversion attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_104079,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Because no vendor patch, workaround, or advisory has been supplied by any tracked source, treat this as unmitigated by default. Enforce least privilege: audit all accounts holding any post-edit capability and remove edit rights from untrusted roles (contributors, low-trust authors) until the flaw is resolved. Where the plugin is not essential, deactivate or remove Envira Gallery Lite. Where it must remain, restrict REST API access at the edge (WAF/reverse proxy) to block unauthenticated or low-privileged calls to the gallery conversion route, and disable the REST API for roles that do not require it. Add server-side moderation so newly created galleries cannot publish automatically, and monitor for galleries created by low-privileged accounts.

2. Patch/upgrade steps. NVD states the issue is fixed in Envira Gallery Lite 1.16.2. Upgrade all installations to 1.16.2 or later as soon as the vendor publishes the release, and verify the installed version on every site. Because no patch source, commit, or changelog was provided in the intelligence feed, confirm the fix against the vendor's official release channel before relying on it. Until an authoritative patch is confirmed available and applied, keep the mitigations in step 1 in force.

3. Long-term hardening. Enforce capability-based authorization on all plugin REST routes (verify the exact capability for the action, not a proxy such as source-post edit rights). Never hard-code publish status; derive it from the caller's capabilities. Validate ownership/authorization for every caller-supplied object identifier (attachment/image IDs). Maintain an inventory of WordPress plugins and versions, subscribe to plugin security feeds, and apply a least-privilege role model across the site.

References

• NVD — CVE-2026-104079: https://nvd.nist.gov/vuln/detail/CVE-2026-104079
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Envira Gallery official site (verify current version/advisory): https://enviragallery.com/
• FIRST.org EPSS (no score currently published for this CVE): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-104079 in the data provided. CISA KEV: NO. No public PoC, exploit code, or Nuclei template was identified at the time of writing.