Unrestricted Plugin Installation via Missing Capability Verification

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does not restrict the installation to its own curated list, allowing a Multisite subsite Administrator to install an arbitrary WordPress.org-published Envira Gallery WordPress plugin before 1.16.2 into the network-shared Envira Gallery WordPress plugin before 1.16.2 directory, a privilege Multisite reserves for the network Super Admin.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Envira Gallery WordPress plugin before version 1.16.2 contains an improper access control vulnerability (CWE-269) in its setup-wizard installation request handler. The plugin fails to verify that users possess the required WordPress capability before processing plugin installation requests, and critically, does not restrict installations to Envira Gallery's curated plugin list. This allows Multisite subsite Administrators—users with limited privileges on individual sites—to install arbitrary WordPress plugins from WordPress.org into their environments. Organizations running WordPress Multisite deployments with Envira Gallery are affected, particularly those with multiple administrative users or managed hosting scenarios where subsite administrators have some autonomy.

Casky's 224 mapped skills detect the attack patterns associated with this vulnerability through MITRE ATT&CK technique TA0004 (Privilege Escalation). Claude AI's extended reasoning identifies the core attack chain: a subsite administrator exploits the missing capability check to bypass intended access controls, then leverages unrestricted plugin installation to deploy malicious or vulnerable plugins that escalate privileges within WordPress. Practitioners using Casky would observe findings indicating insufficient authorization checks in administrative handlers, suspicious plugin installation requests originating from lower-privilege accounts, and installation activities targeting plugins outside expected organizational catalogs. The skills correlate these signals with known privilege escalation patterns, enabling teams to detect both the vulnerability itself and exploitation attempts in real-time across their WordPress infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-104680.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-104680

Casky has 224 skills that investigate the attack patterns behind CVE-2026-104680. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn