CVE-2025-11448
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/envira-convert/v1/bulk-convert' REST API endpoint in all versions up to, and including, 1.11.0. This makes it possible for authenticated attackers, with contributor-level access and above, to convert galleries to Envira galleries.
Risk Assessment
An attacker with a contributor account can modify gallery content, potentially leading to unauthorized site changes and data integrity breaches. This may affect user trust and the organization's reputation.
Recommendation
Update the Envira Photo Gallery plugin to a version newer than 1.11.0 as soon as available. Until then, consider restricting contributor account privileges or disabling the plugin.
Other vulnerabilities in Envira Photo Gallery
See all- CVE-2026-54190Medium
Versions of Envira Photo Gallery up to 1.12.5 have an unauthenticated broken access control vulnerability that may allow attackers to access resources they should not have access to.
- CVE-2025-12377Medium
The Envira Photo Gallery plugin for WordPress up to version 1.12.0 is vulnerable to unauthorized data modification due to missing capability checks in several functions. Authenticated attackers with Author-level access or above can perform multiple actions, such as removing images from arbitrary galleries. The vulnerability was partially patched in version 1.12.0.
Original NVD description (English source)
The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/envira-convert/v1/bulk-convert' REST API endpoint in all versions up to, and including, 1.11.0. This makes it possible for authenticated attackers, with contributor-level access and above, to convert galleries to Envira galleries.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS