Envira Photo Gallery vulnerabilities

Versions of Envira Photo Gallery up to 1.12.5 have an unauthenticated broken access control vulnerability that may allow attackers to access resources they should not have access to.

The Envira Photo Gallery plugin for WordPress up to version 1.12.0 is vulnerable to unauthorized data modification due to missing capability checks in several functions. Authenticated attackers with Author-level access or above can perform multiple actions, such as removing images from arbitrary galleries. The vulnerability was partially patched in version 1.12.0.

The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/envira-convert/v1/bulk-convert' REST API endpoint in all versions up to, and including, 1.11.0. This makes it possible for authenticated attackers, with contributor-level access and above, to convert galleries to Envira galleries.