The Envira Gallery WordPress plugin contains a missing authorization check on its gallery‑conversion REST route. This flaw allows any authenticated user with contributor-level access to specify a post name and create or publish a gallery post that the plugin normally restricts. The result is that contributors can add galleries they are not permitted to create, potentially leading to unauthorized content, site clutter, or defacement. The weakness is a direct lack of proper access control for a privileged operation, classified as improper authorization and missing authorization (CWE‑284 and CWE‑862).

The vulnerability affects the Envira Gallery plugin for WordPress in all releases prior to version 1.16.2. Users running any older build on a WordPress installation are at risk. The plugin’s REST endpoint used for gallery conversion is the entry point. Envira Gallery for WordPress lacks an authorization check on its gallery‑conversion REST route, enabling any user with contributor level access to submit a post name and create or publish gallery content that the plugin otherwise restricts. This flaw allows attackers to bypass the intended creation constraints of the plugin, potentially flooding the site with unauthorized galleries. The weakness is a direct lack of proper access control for a privileged operation.

The vulnerability has a CVSS score of 2.7 and the EPSS score is less than 1%, and it is not listed in the CISA KEV catalog. The missing authorization check represents a low‑impact flaw, as it grants contributors capabilities beyond their intended scope. Likely attack vectors involve authenticated HTTP requests to the plugin’s REST API; an attacker with contributor privileges can exploit the flaw remotely by sending a crafted POST to the conversion route. While the exploitation probability is low, the potential impact on integrity and availability is limited.