CVE-2026-104681: CVE-2026-104681: hassas bilgi ifşası

Açıklama (NVD)

The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.

Özet bilgiler

CVSS v3.1

2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS

%0,23 (yüzdelik 14)

CWE

CWE-200

Yama

Yok / bilinmiyor

Kaynaklar

• NVD kaydı
• wpscan.com
• CWE-200