{"vulnerability": "CVE-2026-104684", "sightings": [{"uuid": "119649c0-7119-4ca8-b2ed-bd53ff095846", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104684", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117420861859879565", "content": "CVE-2026-104684 Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode The Envira Gallery  WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104684https://wpscan.com/vulnerability/b7963d03-d77c-4238-aff3-70b100250936/#CVE_2026_104684#bot", "creation_timestamp": "2026-10-11T06:29:23.150807Z"}]}