CVE-2026-104680: Envira Gallery, заобикаляне на вход и права

Описание

Оригинално описание

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does not restrict the installation to its own curated list, allowing a Multisite subsite Administrator to install an arbitrary WordPress.org-published Envira Gallery WordPress plugin before 1.16.2 into the network-shared Envira Gallery WordPress plugin before 1.16.2 directory, a privilege Multisite reserves for the network Super Admin.

Засегнати продукти

• Unknown Envira Gallery: преди 1.16.2

Вид слабост

• CWE-269 Неправилно управление на привилегии

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-104680
• https://nvd.nist.gov/vuln/detail/CVE-2026-104680
• https://wpscan.com/vulnerability/04e7dc2a-764e-4c0b-b929-d9f1881ef1ca/