CVE-2026-13747
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 5.5.4 because it does not properly verify that a user is authorized to perform an action. An authenticated attacker with author-level access or above can enumerate and read metadata of all private and draft posts, including post ID, title, date, author, and status.
Risk Assessment
An attacker with author-level access can access confidential information about private and draft posts, resulting in a confidentiality breach.
Recommendation
Update the Meow Gallery plugin to a version later than 5.5.4 and review privileges of users with the author role.
Other vulnerabilities in Meow Gallery WordPress plugin
See all- CVE-2026-9239Medium
The Meow Gallery plugin for WordPress is vulnerable to stored cross-site scripting via Attachment Alt Text (aria-label attribute) in all versions up to and including 5.5.1 due to insufficient input sanitization and output escaping. An authenticated attacker with author-level access or above can inject arbitrary scripts that execute when a user accesses an injected page.
- CVE-2026-92423Low
The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data. This allows authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.
- CVE-2026-92422Medium
The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint. This allows unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.
Original NVD description (English source)
The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to enumerate and read metadata — including post ID, title, date, author, and status — of all private and draft posts on the site, including those authored by other users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS