CVE-2026-92423

LowCVSS 2.7

Published: 20/09/2026(UTC)Updated: 21/09/2026(UTC)Translated: 20/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data. This allows authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.

Risk Assessment

An authenticated low-privileged user can access information about other users' private and draft posts. This can lead to leakage of confidential data and information about planned content.

Recommendation

Update the Meow Gallery plugin to version 5.5.5 or later. A review of user permissions for Author role and above is also recommended.

Other vulnerabilities in Meow Gallery WordPress plugin

CVE-2026-92422Medium
The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint. This allows unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.

Original NVD description (English source)

The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS