The Envira Gallery WordPress plugin 1.16.1 and earlier does not verify that a user holds the WordPress capability reserved for plugin installation before processing the onboarding wizard, nor does it restrict new installations to a curated list; this allows a multisite subsite administrator to install any WordPress.org‑published Envira Gallery plugin into the network‑shared directory, effectively breaking the privilege boundaries between subsite administrators and network super admins. Consequently, a subsite administrator can deploy arbitrary code that runs with full network‑wide authority, compromising confidentiality, integrity, and availability whenever the vulnerable plugin is present and the attacker holds subsite administrator credentials, a role that is commonly distributed.

Any WordPress multisite network using Envira Gallery plugin version earlier than 1.16.2, with the vendor not listed in CNA data but the plugin widely distributed via WordPress.org, is affected.

The CVSS score of 7.2 indicates high severity, the EPSS score is below 1%, and the vulnerability is not listed in CISA KEV; the attack vector is local, requiring only subsite‑administrator credentials, which are often available, so the risk of exploitation is high, as a successful attack grants the attacker full network privilege and arbitrary code execution.