The Envira Gallery WordPress plugin prior to version 1.16.2 fails to verify that an image identifier added to a gallery actually references a media attachment that the user is permitted to view. This omission allows any user who can create or edit a gallery—typically authors or higher level roles—to expose the title and excerpt of other users’ private, draft, pending, or trashed posts that WordPress would otherwise keep hidden. The vulnerability represents a classic information disclosure that can reveal sensitive editorial and developmental intent to an unintended audience.

WordPress installations using the Envira Gallery plugin with versions earlier than 1.16.2. Any site that has enabled gallery creation or editing for authors or higher roles is potentially affected, as these users can trigger the disclosure by constructing a gallery that references the compromised identifiers.

The CVSS score is 2.7, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only the ability to create or edit a gallery—a capability normally granted to authors and above. By craftily referencing attachments tied to private posts, an attacker can retrieve those posts’ titles and excerpts via the gallery REST interface or exposed metadata fields. While the risk does not span full code execution, the impact on confidentiality of private editorial content is significant, especially for sites with sensitive unpublished material. The attack vector is local to the WordPress administrative interface and does not require external network access. Due to the lack of an exploitable remote entry point, the operational risk is moderate but non‑negligible for organizations reliant on the confidentiality of draft and pending content.