Envira Gallery Lite before version 1.16.2 has a missing authorization flaw in its gallery conversion REST endpoint. The endpoint lets authenticated users who lack publishing capabilities create and publish new Envira galleries. Attackers can supply arbitrary image IDs that they do not own, causing the galleries to display images or content that the user is not authorized to use. This flaw enables unauthorized reuse of media attachments and publication of potentially copyrighted or sensitive material, compromising the integrity and confidentiality of the site’s content.

The vulnerability affects the Envira Gallery Lite plugin developed by Syed Balkhi. Any installation using a version older than 1.16.2 is impacted. Users should check their plugin version and upgrade to 1.16.2 or later to remove the flaw.

With a CVSS score of 5.3 the exploit is considered moderate. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog. The attack vector is a REST API call performed by any authenticated user who can edit the source post. By providing a hard‑coded publish status, the endpoint bypasses normal capability checks, allowing an attacker with only edit permissions to publish galleries. While no public exploit is documented, the combination of circumvented authorization and lack of ownership validation means that a skilled attacker user access.