Description
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Envira Gallery | < 1.16.2 | 1.16.2 |
References
- https://wpscan.com/vulnerability/b7963d03-d77c-4238-aff3-70b100250936/ exploit vdb-entry technical-description