The Envira Gallery WordPress plugin before version 1.16.2 does not verify that a user is authorized to read a gallery before the gallery is rendered. The plugin allows authors to embed galleries through a shortcode, but the authorization check is omitted, giving any visitor the ability to access metadata of galleries owned by other users. This vulnerability can result in the exposure of private gallery information to unauthenticated users, breaching confidentiality and potentially revealing sensitive content about users and site owners.

The flaw affects all installations of the Envira Gallery plugin on WordPress sites that are running a version older than 1.16.2. The plugin is distributed through the WordPress plugin repository and is used by many sites that host private image collections.

The CVSS base score is 2.7 and the EPSS score is less than 1%, and the vulnerability is not in KEV, but the lack of authentication control still allows unauthorized disclosure. An attacker only needs the ability to place or modify a shortcode on a page or to construct a gallery URL that targets another user’s gallery. Once the shortcode is executed, the gallery metadata is returned in the page response, revealing information that should have been restricted. This can be exploited remotely from the public Internet without requiring privileged credentials.