The Envira Gallery plugin for WordPress contains a missing capability check that allows an authenticated user with Author-level or higher permissions to modify gallery contents. This gives such an attacker the ability to delete or otherwise alter images in any gallery, potentially compromising the integrity and availability of site media. The weakness is identified as CWE‑862: Missing Authorization.

The vulnerability affects the smub Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More plugin, all releases up to and including version 1.12.0. Users should verify the installed plugin version and consider upgrading beyond the affected releases.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is unlikely at present, and the vulnerability is not currently listed in the CISA KEV catalog. Because the attacker must be authenticated with Author-level access, the attack surface is limited to sites that allow such roles to log in. A compromise would enable manipulation of gallery content but would not provide remote code execution or data exfiltration of other site data.